Denial Of Service
Monthly
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.
LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.
Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Microsoft Office via a use-after-free (CWE-416) memory corruption flaw allows a network-adjacent or remote attacker to execute arbitrary code on the victim's machine. The attack is client-side: the attacker delivers a maliciously crafted Office document, which when opened by the user triggers the UAF condition. Affected products span the full Office family including LTSC 2021, LTSC 2024, Office 2019, Microsoft 365 Apps for Enterprise, and Mac variants; a vendor patch is available.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.
Remote code execution is possible in Windows Remote Desktop Services via a use-after-free memory corruption flaw, affecting Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. An authenticated, network-connected attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system. CVSS 7.5 (AV:N/AC:H/PR:L) reflects that exploitation requires low-privilege authentication and high attack complexity, making opportunistic mass exploitation less likely; no public exploit has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows HTTP.sys kernel-mode driver allows a low-privileged authenticated attacker to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2025 hosts via a network attack path. The vulnerability (CWE-416) carries CVSS 7.1 with AC:H and UI:R, indicating a race-condition-dependent exploit requiring specific concurrent conditions rather than a simple reliable trigger. No public exploit identified at time of analysis; Microsoft has released cumulative update patches for all affected builds.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use After Free in Adobe Acrobat Reader allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious document. Affected versions span both the continuous-track Acrobat/Acrobat Reader (≤26.002.21900) and the Acrobat 2024 classic track (≤24.001.30383). No public exploit or CISA KEV listing is identified at time of analysis, but the combination of a widely deployed document reader, file-open delivery vector, and full C/I/A impact makes this a high-priority patching target for enterprise environments.
Use-after-free (CWE-416) in Adobe Acrobat Reader enables arbitrary code execution at the current user's privilege level when a specially crafted document is opened. All Acrobat Reader builds through 26.002.21900 and Acrobat 2024 through 24.001.30383 are affected, as confirmed by Adobe PSIRT under security bulletin APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-borne delivery mechanism makes this a classic phishing/email-attack vector in enterprise environments.
Use-after-free memory corruption in Adobe Acrobat Reader and Acrobat (continuous track ≤26.002.21900; 2024 classic track ≤24.001.30383) enables arbitrary code execution in the context of the victim's user account. The flaw is triggered when a victim opens a specially crafted PDF file, making phishing campaigns and malicious web downloads the primary real-world delivery vectors. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the attack primitive is consistent with historically weaponized Acrobat vulnerabilities.
Use After Free in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a maliciously crafted PDF or document file. All versions through 26.002.21900 (continuous track) and 24.001.30383 (Classic 2024) are confirmed affected per EUVD-2026-74104. No public exploit or CISA KEV listing has been identified at time of analysis, but the local-execution, user-interaction requirement limits automated mass exploitation while remaining highly practical in phishing and spear-phishing campaigns.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.
LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution across Android versions 14 through 17 is possible via a use-after-free condition triggered by a race condition in multiple OS locations. The CVSS vector (AV:N/AC:H/PR:L/UI:N) places this as a network-reachable, low-privilege attack requiring no user interaction but demanding precise timing due to the race condition mechanics, with full confidentiality, integrity, and availability impact on successful exploitation. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low current observed exploitation pressure despite the broad attack surface spanning essentially all actively supported Android versions.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Use-after-free in the Windows Cloud Files Mini Filter Driver enables a locally authenticated low-privileged attacker to escalate privileges on affected Windows systems. The vulnerability spans a wide range of Windows versions - Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed attack surface broad. No public exploit or active exploitation has been confirmed at time of analysis, but the component is loaded on virtually all modern Windows systems that use cloud sync features.
Remote code execution in Microsoft 365 Apps for Enterprise PowerPoint (versions below 16.0.20326.20136) is possible via a use-after-free (CWE-416) triggered when a user opens a specially crafted PowerPoint file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full CIA impact achievable without attacker authentication, requiring only that the victim opens a malicious document. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but Microsoft has released a patch and the memory corruption primitive makes this a high-priority update for enterprise environments.
Remote code execution via use-after-free (CWE-416) in Microsoft Office Outlook allows a network-based attacker to execute arbitrary code on a victim's system when the user opens or previews malicious content. The vulnerability affects a broad range of Microsoft Office versions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Word 2016. No public exploit identified at time of analysis, but a vendor patch is available; the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects the high severity, tempered only by the requirement for user interaction.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Privilege escalation in Windows Security Health Service (a core Windows security monitoring component) allows a locally authenticated attacker with standard user privileges to gain SYSTEM-level access via a use-after-free memory corruption flaw. Affected platforms span Windows 11 (24H2, 25H2, 26H1) and Windows Server 2022/2025 - all fully patched by Microsoft's latest cumulative updates. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 7.0 with AC:H reflects real exploitation complexity.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Type confusion (CWE-843) in the Windows DHCP Server service enables unauthenticated remote attackers to crash or deny service to the DHCP daemon over the network. The flaw spans Windows Server 2012 through 2025 and Windows 10 builds where the DHCP Server role is installed. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.5 AV:N/AC:L/PR:N/UI:N vector signals straightforward, low-complexity network exploitation requiring no authentication.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows any low-privileged authenticated user to gain SYSTEM-level access via a null pointer dereference (CWE-476) in the Windows Biometric Framework. Affecting Windows 10 through Windows 11 26H1 and Windows Server 2016 through 2025, the flaw is present across virtually the entire modern Windows ecosystem. No public exploit identified at time of analysis; Microsoft has released patches across all affected branches.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Remote code execution in the Windows Failover Cluster service allows an unauthenticated attacker to run arbitrary code over the network by triggering a use-after-free condition. The flaw affects Windows Server 2019, 2022, and 2025 (including Server Core) and Windows 10 Version 1809, with a Microsoft-issued patch available. No public exploit is identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a top-priority Patch Tuesday item for clustered server estates.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. No public exploit is identified at time of analysis; exposure in practice is gated on hosts actually running an SSTP VPN listener.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Use-after-free in the Windows Device Association Service enables a local low-privileged attacker to escalate to full system-level privileges across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability stems from improper memory management in the service responsible for pairing devices, where a freed memory region can be reused to redirect execution. Microsoft has released patches addressing all affected builds; no public exploit or CISA KEV listing is recorded at time of analysis, though the high-complexity (AC:H) requirement means reliable exploitation demands careful timing or race-condition abuse.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Privilege escalation through a use-after-free condition in the Windows Win32K kernel subsystem allows a low-privileged local attacker to achieve SYSTEM-level access across a wide range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. The flaw resides in win32k.sys, the kernel-mode driver implementing the Windows graphical subsystem (GDI/USER32), and requires high attack complexity to trigger reliably - consistent with race-condition or heap-grooming exploitation techniques. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft MSRC.
Use-after-free (CWE-416) in Windows Message Queuing (MSMQ) allows a locally authenticated low-privileged attacker to escalate privileges to a higher integrity level on affected Windows systems. The vulnerability spans a wide range of Windows releases from Server 2012 through Windows 11 26H1, and Microsoft has released patches across all affected build lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution in Microsoft Office via a use-after-free (CWE-416) memory corruption flaw allows a network-adjacent or remote attacker to execute arbitrary code on the victim's machine. The attack is client-side: the attacker delivers a maliciously crafted Office document, which when opened by the user triggers the UAF condition. Affected products span the full Office family including LTSC 2021, LTSC 2024, Office 2019, Microsoft 365 Apps for Enterprise, and Mac variants; a vendor patch is available.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privileged local attacker to gain full SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server versions. The flaw stems from a use-after-free (CWE-416) condition in a kernel-mode driver, with high attack complexity indicating a likely race condition or specific timing requirement. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Shell on Windows 11 (versions 23H2 through 26H1) and Windows Server 2025 stems from a use-after-free memory corruption flaw (CWE-416). An authenticated local attacker who triggers the race-condition-sensitive bug can achieve full system compromise with C:H/I:H/A:H impact, yielding effective SYSTEM-level control. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has confirmed and patched the issue across all affected builds as documented in EUVD-2026-73549.
Remote code execution is possible in Windows Remote Desktop Services via a use-after-free memory corruption flaw, affecting Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025. An authenticated, network-connected attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system. CVSS 7.5 (AV:N/AC:H/PR:L) reflects that exploitation requires low-privilege authentication and high attack complexity, making opportunistic mass exploitation less likely; no public exploit has been identified at time of analysis.
Privilege escalation via use-after-free in the Windows HTTP.sys kernel-mode driver allows a low-privileged authenticated attacker to gain full SYSTEM-level control over affected Windows 11 and Windows Server 2025 hosts via a network attack path. The vulnerability (CWE-416) carries CVSS 7.1 with AC:H and UI:R, indicating a race-condition-dependent exploit requiring specific concurrent conditions rather than a simple reliable trigger. No public exploit identified at time of analysis; Microsoft has released cumulative update patches for all affected builds.
Remote code execution in Microsoft's Windows Services for NFS role - specifically the ONCRPC XDR driver - allows a network attacker to trigger a use-after-free (CWE-416) and execute arbitrary code without authentication. All supported Windows Server releases from Server 2012 through Server 2025 (including Server Core installations) are affected when the Services for NFS role is present. Microsoft has released patches; no public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make it a high-priority patch for hosts running NFS.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension allows unauthenticated remote attackers to crash the IKE service and deny VPN/IPsec negotiation to legitimate users. Affected systems span Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. Microsoft has released patches via the Security Response Center update guide; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Remote code execution via use-after-free (CWE-416) in Active Directory Domain Services (ADDS) affects an exceptionally broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the memory corruption condition in the ADDS service, potentially yielding arbitrary code execution with full confidentiality, integrity, and availability impact on targeted domain controllers. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Local privilege escalation in the Windows Audio Video Control Transport Protocol (AVCTP) Bluetooth stack allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 systems. The root cause is a use-after-free (CWE-416) in the AVCTP driver, where freed memory is subsequently accessed, enabling controlled memory corruption. No public exploit or CISA KEV listing exists at time of analysis; however, the full C:H/I:H/A:H impact and widespread Windows deployment make this a meaningful patching priority for endpoint and server administrators.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.