Heap Overflow
Monthly
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.
Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.
Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.
Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows Graphics Kernel allows an authenticated local attacker with low privileges to gain elevated (likely SYSTEM) privileges by triggering a heap-based buffer overflow. Affected versions include Windows 11 24H2, 25H2, and 26H2 prior to builds 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711 respectively, and Windows Server 2025 (including Server Core) prior to 10.0.26100.33650. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) suggests exploitation requires precise heap grooming or winning a race condition, reducing reliability.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.
Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.
Local privilege escalation in the Windows Reliable Multicast Transport Driver (RMCAST, pgm.sys) lets an attacker who already holds low-privileged local access on a vulnerable host win a time-of-check time-of-use race and elevate to SYSTEM-level execution. The flaw is not remotely reachable: exploitation requires a pre-existing local, authenticated foothold (AV:L/PR:L) and must be repeated many times to reliably hit the narrow check/use window (AC:H), but a successful race yields full confidentiality, integrity, and availability impact. Microsoft has released fixed builds for the affected Windows 10, Windows 11, and Windows Server branches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and no EPSS score was supplied with the source data.
Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
Local privilege escalation in the Windows UI Immersive Server component allows an attacker who already holds a low-privileged local account on a Windows host to corrupt heap memory via a crafted input and elevate to a higher-integrity context, including SYSTEM. Affected systems are all supported Windows client and server editions running builds below the fixed patch level, ranging from Windows 10 1607 and Windows Server 2012 up through Windows 11 26H2 and Windows Server 2025; patched builds are not exploitable, and there is no remote or unauthenticated path. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and non-automatable, and no EPSS score was supplied, so the practical risk is a serious but post-compromise local escalation flaw rather than an emergency-grade, mass-exploitable issue; a vendor patch is available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Microsoft Windows WebDAV component allows an authenticated low-privileged user to trigger a heap-based buffer overflow and gain code execution at a higher integrity level on the affected host. Exploitation requires a pre-existing local foothold (AV:L, PR:L, UI:N) plus reliable heap grooming or race-condition success (AC:H), making this a post-compromise escalation primitive rather than a remote or unauthenticated entry point. It affects unpatched Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 builds below their respective patched thresholds; no public exploit code has been identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied with the record.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Local privilege escalation in Windows Direct Composition - the desktop compositor subsystem shipped by default in Windows 11 24H2, 25H2 and 26H2 and in Windows Server 2025, including Server Core - lets an attacker who already holds low-privilege local access corrupt heap memory and execute code at a higher integrity level (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is bounded by the prerequisite of an existing authenticated foothold on the host, so this is a post-compromise escalation primitive rather than a remote entry point; the independent assessment rates it a credible but not emergency-level priority. A vendor patch is available from Microsoft, and there is no public exploit identified at time of analysis (SSVC exploitation: none) and no KEV listing.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow in Microsoft PowerPoint allows an unauthenticated attacker to execute arbitrary code in the security context of a user who opens a specially crafted presentation file, with impact rated to confidentiality, integrity, and availability all High. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 for Windows, and Office 365 / Office LTSC 2021 and 2024 for Mac; exploitation requires the victim to open the malicious file (UI:R) delivered out-of-band via email, chat, or web download, and the high attack complexity metric reflects additional attacker-side prerequisites such as winning a specific heap memory layout. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limits on exploitation remain the required user interaction plus Protected View and Mark-of-the-Web protections applied to files from untrusted sources.
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.
Heap-based buffer overflow in Microsoft Office allows unauthenticated remote attackers to execute arbitrary code in the context of the victim user, but only if that user is convinced to open a specially crafted document (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected installations span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC 2021/2024 plus Office 365 for Mac, so both Windows and macOS environments are in scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and the mandatory user interaction (UI:R) - together with Protected View and untrusted-document blocking - is the principal factor limiting real-world exposure; this is a credible prioritization candidate rather than a top-tier emergency on current signals. Microsoft has released vendor patches addressing the flaw.
Remote code execution in Microsoft Office allows an unauthenticated attacker to execute arbitrary code by convincing a user to open a specially crafted document. This heap-based buffer overflow affects Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and Mac versions of Office LTSC 2021/2024 and Office 365 for Mac. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the vulnerability is high-priority due to total technical impact and network attack vector; patching is available from Microsoft.
Heap-based buffer overflow in the Microsoft Scripting Engine (CWE-122) allows an authenticated attacker with an existing low-privileged foothold on a Windows host to have crafted script content parsed into an out-of-bounds heap write, escalating privileges to the integrity level of the scripting host process with high confidentiality, integrity and availability impact (CVSS 7.8). Because the assessed vector is AV:L/PR:L/UI:N/AC:L, the vulnerability is not remotely reachable and no victim interaction is required, so its realistic value is post-initial-access privilege escalation rather than a remote compromise path. Patch available per vendor advisory through the Microsoft MSRC update guide; no public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
Remote code execution in Microsoft Word for Windows and macOS is possible through a heap-based buffer overflow (CWE-122) that is triggered when an affected Office build processes a specially crafted Word document delivered over a network, typically as an email attachment or a web download. The vulnerability is unauthenticated (PR:N) but requires user interaction: the victim must open the malicious document, and the AC:H rating reflects that the attacker must achieve reliable heap layout and grooming to convert the memory corruption into code execution. When successful the outcome is total loss of confidentiality, integrity and availability on the victim's system, although no public exploit code has been identified and CISA's SSVC review records no active exploitation and no automatable path, making this a targeted-attack risk rather than a wormable or mass-exploitation event. Microsoft has released patched builds for the affected Windows and macOS channels.
Local privilege escalation in the Windows Bind Filter Driver (BindFlt), a kernel-mode component shipped by default across supported Windows client and server editions, lets an already-authenticated low-privileged attacker trigger a heap-based buffer overflow and gain elevated (SYSTEM) code execution on the host. Exploitation requires a pre-existing local foothold - the CVSS vector is AV:L/PR:L/UI:N - so this is a post-compromise escalation primitive rather than a remotely reachable entry point, and it carries a high technical impact (total loss of confidentiality, integrity and availability on the affected machine). No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no', so this is a credible but not emergency-tier patching priority; Microsoft has released fixed builds for every affected edition and organizations should fold them into normal cumulative-update cycles, prioritizing multi-user and high-value hosts.
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.20190) allows a low-privileged account holder to send crafted input over the network and corrupt heap memory, potentially gaining full control of the server's confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires only a valid low-privileged SharePoint account plus network reachability to the server - no user interaction - so any farm that issues accounts to untrusted or external users should treat this as high priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published a fixed build via its update guide (MSRC advisory CVE-2026-88163), making patching the straightforward path to closure.
Heap-based buffer overflow in OpenSSH for Windows can let an unauthenticated network attacker execute code, but the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and the independent assessment indicate the victim must initiate the vulnerable SSH operation, likely by using an affected Windows OpenSSH client against an attacker-controlled or compromised SSH server. Affected builds span Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025 as enumerated in EUVD-2026-99587; Microsoft has released patched builds through the MSRC update guide. No public exploit identified at time of analysis, and CISA SSVC marks exploitation as none and Automatable as no, so risk is gated by user interaction and the need for the victim to connect to attacker-influenced infrastructure.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.20326.20190, where a heap-based buffer overflow (CWE-122) can be triggered over the network by an attacker holding valid low-privilege credentials, with no user interaction required. A vendor patch is available, and intelligence sources indicate no public exploit identified at time of analysis and SSVC exploitation: none, so this is a credible but not emergency-tier priority primarily constrained by the authentication requirement.
Local privilege escalation in the Windows Secure Socket Tunneling Protocol (SSTP) component allows an authenticated, low-privileged user on an affected host to trigger a heap-based buffer overflow and obtain high-integrity code execution in the context of the vulnerable service (CVSS 7.8, CWE-122). Exploitation requires a pre-existing local foothold with valid low-privileged credentials (AV:L/PR:L) and no user interaction (UI:N), so the flaw functions as a privilege-escalation link in a post-compromise chain rather than a remote entry point; there is no CISA KEV listing and no public exploit code identified at time of analysis. Microsoft has shipped a vendor patch, and ENISA EUVD tracks the issue as EUVD-2026-100095, making this a moderate-but-real priority concentrated on multi-user, RDP/terminal, and Windows Server hosts where untrusted local principals exist.
Remote code execution in Microsoft Excel allows an unauthorized attacker to run arbitrary code on a victim's machine when the target opens a specially crafted workbook, delivered over a network via email attachment, web download, or a shared file. The flaw is a heap-based buffer overflow (CWE-122) in affected Office builds, carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no authentication or prior access is required, but the attacker is dependent on the victim opening the file, which is why CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Affected configurations include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, and the listed macOS Office editions prior to their fixed builds. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, so this is a high-priority but not top-of-queue patch item; no EPSS probability was supplied with the source data.
Memory corruption in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated, low-privileged attacker to execute arbitrary code over the network, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. Because BITS is a default-enabled core component of every supported Windows client and server edition listed in the EUVD data, no feature toggle has to be turned on for exposure - but the CVSS vector's PR:L metric means the attacker must already hold a low-privileged foothold, and CISA's SSVC assessment marks the flaw as not automatable, so no wormable mass-exploitation path is indicated. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor patches are available, making this a high-priority but not emergency-outbreak patching target.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated attacker with low-privileged local access to gain SYSTEM-level privileges by triggering a heap-based buffer overflow. The vulnerability requires local access (AV:L) and low privileges (PR:L) but no user interaction (UI:N), and is not remotely reachable or automatable at scale per CISA SSVC (Automatable: no). Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none).
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker with low-level privileges to exploit a memory corruption flaw and gain higher privileges on affected Windows client and server systems. The vulnerable BITS component is default-enabled and reachable without non-default configuration, but exploitation requires a pre-existing local foothold and no user interaction, with no remote or network vector. Vendor patch is available; no public exploit identified at time of analysis, and the independent assessment rates this as a credible but not emergency-level priority.
Local privilege escalation in Microsoft Windows Graphics Kernel allows an authenticated local attacker with low privileges to gain elevated (likely SYSTEM) privileges by triggering a heap-based buffer overflow. Affected versions include Windows 11 24H2, 25H2, and 26H2 prior to builds 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711 respectively, and Windows Server 2025 (including Server Core) prior to 10.0.26100.33650. No public exploit code or active exploitation has been identified, and the high attack complexity (AC:H) suggests exploitation requires precise heap grooming or winning a race condition, reducing reliability.
Local privilege escalation in Windows Desktop Window Manager allows a low-privileged attacker who already has code execution on a host to corrupt DWM's heap and escalate to a higher-integrity, SYSTEM-level context. Microsoft rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing local foothold under a valid account (PR:L) attained through local interaction with DWM (AV:L), with no victim user interaction (UI:N) and low attack complexity, making it a straightforward post-compromise escalation step rather than a remotely reachable flaw. Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26Hx) and Windows Server 2019/2022/2025 builds below the fixed versions are affected; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and vendor patches are available. This is a credible operational priority but not a mass-exploitation emergency.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Local privilege escalation in the Microsoft Windows Fax and Scan Service lets an authenticated low-privileged user on the host trigger a heap-based buffer overflow (CWE-122) and gain code execution at a higher integrity level, including SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a local foothold and valid credentials but needs no user interaction and faces low attack complexity; hosts where the Fax and Scan Service is disabled, removed, or unreachable by standard users are not exposed. Per CISA SSVC the exploitation status is "none" and the issue is not automatable, and no public exploit code has been identified at time of analysis - this is a credible but second-tier patch-priority item rather than an active emergency.
Privilege escalation in the Windows Storage Spaces Controller allows an authenticated attacker with existing low-privileged local code execution to corrupt kernel heap memory and elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a heap-based buffer overflow (CWE-122) reachable locally with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it functions as a post-compromise escalation primitive rather than a remote entry point; prior local access and valid credentials are required. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released fixed builds across all affected branches.
Local privilege escalation in Windows Winlogon (CVE-2026-87699) allows an attacker who already holds an authenticated low-privileged session on a target machine to trigger a heap-based buffer overflow in the Winlogon process and elevate to full SYSTEM-level privileges, yielding high confidentiality, integrity, and availability impact on that host. The flaw affects a broad set of Windows 10, Windows 11, and Windows Server 2012 through Server 2025 builds below the fixed revisions published by Microsoft (for example Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, and Windows Server 2016 below 10.0.14393.9612), and the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N scores it 7.8. There is no public exploit identified at time of analysis, and CISA's SSVC records exploitation as 'none', but the fully local, no-user-interaction attack path makes this an effective post-compromise escalation step for an attacker already present on a host.
Local privilege escalation in the Windows Reliable Multicast Transport Driver (RMCAST, pgm.sys) lets an attacker who already holds low-privileged local access on a vulnerable host win a time-of-check time-of-use race and elevate to SYSTEM-level execution. The flaw is not remotely reachable: exploitation requires a pre-existing local, authenticated foothold (AV:L/PR:L) and must be repeated many times to reliably hit the narrow check/use window (AC:H), but a successful race yields full confidentiality, integrity, and availability impact. Microsoft has released fixed builds for the affected Windows 10, Windows 11, and Windows Server branches; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and no EPSS score was supplied with the source data.
Heap corruption in the Microsoft Windows Shell allows an unauthenticated remote attacker to execute arbitrary code in the context of a user who opens or interacts with attacker-supplied Shell content, such as a crafted file, link, or shell item. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is gated by mandatory user interaction and CISA's SSVC assessment records exploitation as 'none' and the attack as not automatable, so it is best suited to targeted social-engineering delivery rather than unattended mass exploitation; no public exploit identified at time of analysis. The affected build range is broad, covering Windows 10, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025.
Heap-based buffer overflow in the Windows Distributed File System (DFS) allows an authenticated, network-positioned attacker to execute arbitrary code on a vulnerable host, carrying high confidentiality, integrity, and availability impact (CVSS 8.8). Affected platforms span Windows Server 2012 through Server 2025 and Windows 10/11 builds below the fixed builds catalogued by ENISA EUVD, and exploitation requires valid network-accessible credentials (PR:L per the CVSS vector) plus reachability to the DFS service - the authentication requirement and the absence of user interaction are the two defining gates. Exploitation status is currently benign: CISA's SSVC assessment rates Exploitation as none and Automatable as no, there is no KEV listing, and no public exploit identified at time of analysis, so the practical urgency is lower than the raw 8.8 score suggests.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver lets an unauthenticated remote attacker execute code in kernel context on affected default Windows installations, scoring CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released a vendor patch, and CISA's SSVC assessment rates the flaw as automatable with total technical impact, but no exploitation has been observed and no public exploit code exists - so the practical risk hinges on whether a reachable network path to the driver actually exists, since a storage/volume driver is not inherently internet-facing. Every supported Windows client and server branch from Windows 10 1607 through Windows 11 26H2, plus Server 2012 through Server 2025, is enumerated as affected below the fixed build numbers.
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
Local privilege escalation in the Windows PCI Bus Driver (pci.sys) lets an attacker who already holds low-privileged local access on a Windows host trigger a heap-based buffer overflow in kernel mode, corrupting pooled kernel memory and achieving high-integrity (SYSTEM) code execution. Affected systems are Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 builds below the fixed build numbers published by Microsoft; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for a score of 7.8, meaning the attacker must already possess local, authenticated low-privileged access and no user interaction is required. CISA's SSVC assessment records exploitation as 'none' and high technical impact, but rates the flaw non-automatable and no public exploit code has been identified at time of analysis - this is a post-compromise privilege-escalation primitive that matters most on multi-user, RDP, VDI and shared-host deployments rather than a remotely reachable mass-exploitation risk.
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
Local privilege escalation in the Windows UI Immersive Server component allows an attacker who already holds a low-privileged local account on a Windows host to corrupt heap memory via a crafted input and elevate to a higher-integrity context, including SYSTEM. Affected systems are all supported Windows client and server editions running builds below the fixed patch level, ranging from Windows 10 1607 and Windows Server 2012 up through Windows 11 26H2 and Windows Server 2025; patched builds are not exploitable, and there is no remote or unauthenticated path. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and non-automatable, and no EPSS score was supplied, so the practical risk is a serious but post-compromise local escalation flaw rather than an emergency-grade, mass-exploitable issue; a vendor patch is available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Privilege escalation in the Windows kernel-mode drivers lets an authenticated attacker who already holds low-privileged local code execution on a host trigger a heap-based buffer overflow and elevate to SYSTEM-level rights. Affected are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds below their respective patched revisions. This is strictly a post-compromise local escalation (CVSS 3.1 7.8, AV:L/PR:L/UI:N) with no remote or network-facing attack surface; no public exploit code has been identified at time of analysis and there is no KEV listing, so it should be treated as a high-value chaining primitive rather than an initial-access vector.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an attacker who already holds valid credentials and code-execution capability on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw affects essentially every supported Windows release, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025, on builds below the fixed numbers published in EUVD-2026-99570. Exploitation is gated by High attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0), because the corruption must be shaped into reliable kernel memory manipulation; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released patches.
Local privilege escalation in the Microsoft Windows Search Component (CWE-122 heap-based buffer overflow) allows an attacker who already holds a low-privileged, authenticated local foothold on a Windows host to corrupt heap memory and achieve high-impact code execution. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming the flaw is not remotely triggerable and needs no victim interaction, but does require the attacker to already be running code locally. Affected builds span Windows 10, Windows 11, and Windows Server 2012 through 2025; Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based memory corruption in the Windows Remote Access Connection Manager (RasMan) service lets a locally authenticated, low-privileged user corrupt heap memory and escalate privileges into the service's elevated security context on affected Windows 10, Windows 11 and Windows Server builds. The path is purely local and requires an existing foothold with standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), and CISA's SSVC rates exploitation as none with non-automatable attacks but total technical impact. There is no public exploit identified at time of analysis, and Microsoft has released fixed builds, so this is a credible but not emergency-tier priority - highest for hosts where untrusted or semi-trusted users already have interactive local access.
Heap-based buffer overflow in the Windows Internet Connection Sharing (ICS) component allows an authenticated low-privilege attacker positioned on an adjacent network segment to execute arbitrary code on affected hosts, with high confidentiality, integrity, and availability impact per the assessed vector (CVSS 7.1, AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is constrained: ICS must actually be running (it is not enabled by default on mainstream Windows client or server installations), the attacker must already hold low-privileged credentials, must be local/link-local to the target rather than routed over the internet, and must satisfy high-complexity heap-grooming and timing conditions (AC:H). No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); vendor patches are available, so this is a moderately-high-priority but not emergency-tier issue.
A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authenticated local attacker to gain SYSTEM-level privileges on affected hosts. Exploitation requires an existing foothold with at least low-level user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8); the BITS service runs by default on all supported Windows versions and needs no non-default configuration, so the only real barrier is the local attack vector. The vulnerability spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); Microsoft has released patched builds via the monthly update channel.
Local privilege escalation in the Windows kernel TCP/IP stack allows an attacker who already holds a low-privilege foothold on a host to trigger a heap-based buffer overflow (CWE-122) and corrupt kernel memory, potentially gaining code execution at SYSTEM level. Successful exploitation requires local access with low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N) and no user interaction, but the high attack complexity reflects the heap grooming or race conditions typically needed to turn kernel pool corruption into reliable code execution, so attempts are non-deterministic. Microsoft has published fixes for affected Windows 10, Windows 11, and Windows Server builds; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure is highest on multi-user, RDP, or shared workstation hosts where untrusted users can run local code.
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
Local privilege escalation in the WebDAV component of Microsoft Windows (CVE-2026-85828, CVSS 7.0) lets a low-privileged authenticated attacker who already holds a foothold on the host corrupt heap memory and gain elevated rights. Exploitation is local only (AV:L) and gated by high attack complexity (AC:H), reflecting the heap-layout or timing control needed to reliably win the CWE-122 overflow, so success is probabilistic rather than guaranteed; there is no network-facing path indicated in the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released patched builds for all affected Windows client and server branches via the MSRC update guide. This is best treated as a moderate-priority post-compromise hardening item rather than a critical remotely exploitable issue.
Local privilege escalation in the Microsoft Windows WebDAV component allows an authenticated low-privileged user to trigger a heap-based buffer overflow and gain code execution at a higher integrity level on the affected host. Exploitation requires a pre-existing local foothold (AV:L, PR:L, UI:N) plus reliable heap grooming or race-condition success (AC:H), making this a post-compromise escalation primitive rather than a remote or unauthenticated entry point. It affects unpatched Windows 10 1607/1809/21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 builds below their respective patched thresholds; no public exploit code has been identified at time of analysis, no CISA KEV entry is present, and no EPSS score was supplied with the record.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows TCP/IP driver lets an attacker who already holds low-privileged code execution on a host trigger a heap-based buffer overflow and obtain SYSTEM-level rights, with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The defect affects an unusually broad range of supported builds - Windows 10 versions 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012 through 2025 including Server Core installations. Microsoft has released a vendor patch, and there is no public exploit code and no confirmed active exploitation at time of analysis (CISA KEV does not list it; CISA SSVC records exploitation as 'none'). Because the flaw is local and requires an existing foothold, it is best treated as a post-compromise escalation primitive rather than a remotely reachable network flaw despite the TCP/IP component name.
Local privilege escalation in Microsoft Windows Installer (msiexec/msiserver) allows an authenticated attacker who already holds a low-privilege foothold on a Windows host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/SYSTEM-level code execution with full confidentiality, integrity, and availability impact. The flaw affects essentially the entire supported Windows client and server estate documented by EUVD, from Windows 10 1607, Windows Server 2012 and 2012 R2 through Windows 11 26H2 and Windows Server 2025, and is exploitable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U, base 7.8). Because it is strictly local (AV:L) it cannot be reached across the network, and with CISA's SSVC recording Exploitation=none and Automatable=no, and no public exploit code identified at time of analysis, this is a credible second-stage escalation step for an attacker who has already landed on the box rather than a mass-exploitation or initial-access vector.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Local privilege escalation in Microsoft Windows Installer lets an authenticated attacker who already holds a low-privileged foothold on a host trigger a heap-based buffer overflow (CWE-122) and elevate to a higher-privileged context, with full impact to confidentiality, integrity, and availability within the same security scope (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and requires no user interaction once local access is obtained, so it is primarily a post-compromise escalation primitive rather than an initial-access vector. It affects a broad range of Windows 10, Windows 11, and Windows Server editions up to specific build numbers, and no public exploit has been identified at time of analysis (CISA SSVC exploitation: none); Microsoft has published a vendor fix that closes the vulnerable heap-allocation code path on patched builds.
Local privilege escalation in the Windows USB Video Driver allows an authenticated attacker holding a low-privileged account on the target host to trigger a heap-based buffer overflow (CWE-122) and gain high-integrity/kernel-level code execution. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below their respective fixed versions, per the vendor's affected-version data. Exploitation is local-only (AV:L/PR:L/UI:N), so it requires pre-existing code execution on the host and is not remotely reachable; no public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and there is no KEV listing, making this a credible but moderate-priority privilege-escalation issue rather than an emergency. Microsoft has released patches ("Available from vendor") and all affected builds have published fixed version numbers.
Remote code execution in Microsoft's Windows Routing and Remote Access Service (RRAS) lets a remote, unauthenticated attacker corrupt heap memory and execute code on affected hosts, though exploitation requires the victim to perform an action (UI:R) such as initiating or accepting a connection to attacker-controlled remote-access traffic. The Routing and Remote Access Service is an optional Windows role that is not installed by default, which sharply limits the exposed population to systems explicitly configured as VPN or dial-up servers. No public exploit code has been identified at time of analysis and the CISA SSVC assessment records exploitation as 'none'; Microsoft has released fixes, and all Windows 10/11 and Windows Server 2012 through 2025 builds below the fixed revisions listed by EUVD are affected.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Heap-based buffer overflow (CWE-122) in the Windows Servicing Stack component allows an authenticated, low-privileged local attacker to elevate privileges to full system rights on unpatched Windows client and server builds. Exploitation is not a standalone remote entry point: the attacker must already have local code execution on the host (CVSS vector AV:L/PR:L/UI:N), and CISA's SSVC assessment rates the attack as non-automatable with no observed exploitation; no public exploit code has been identified at time of analysis. Vendor fixes have been released as updated SSU build numbers across all affected branches (for example Windows 11 24H2 fixed at 10.0.26100.9711, Windows Server 2025 at 10.0.26100.33650, and Windows 10 1809 / Server 2019 at 10.0.17763.9376).
Heap-based buffer overflow in the Microsoft Windows Routing and Remote Access Service (RRAS) PPP EAP-TLS implementation allows an unauthenticated, remote attacker to execute code on an affected host by sending a crafted EAP-TLS message to an exposed PPP endpoint. The vulnerable code path is only reachable when the Remote Access role is deployed and configured for PPP with EAP-TLS authentication, which is not a default Windows configuration; hosts without that role enabled are not exposed. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects total compromise potential, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as none, so the practical risk is concentrated in organizations that deliberately run RRAS with EAP-TLS.
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
Heap-based buffer overflow in Microsoft XML (MSXML) shipped with supported Windows 10, Windows 11, and Windows Server releases allows remote attackers to execute code in the context of the parsing process if they can deliver crafted XML content to it. The bug carries a 9.8 CVSS score under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires no authentication and no user interaction per the vendor's own scoring, and the affected surface spans every listed build from Server 2012 and 2012 R2 up through Windows 11 26H2 and Windows Server 2025. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', but automatable is rated 'yes' and technical impact 'total', so the absence of observed exploitation should be read as a detection lag rather than a low likelihood. Vendor-released patches are available; applying the listed minimum build versions removes the condition.
Local privilege escalation in Windows Group Policy lets an authenticated, low-privileged user on an unpatched Windows host overflow heap memory and escalate to SYSTEM-level code execution. The defect is a heap-based buffer overflow (CWE-122) reachable only after the attacker already holds a local foothold - there is no remote vector (AV:L), no user interaction is required (UI:N), and successful exploitation yields full loss of confidentiality, integrity, and availability for the host. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; CISA's SSVC assessment marks the flaw as non-automatable, making it a credible but not emergency-tier patching priority.
Heap-based buffer overflow in Microsoft Windows Hyper-V allows a locally positioned, authenticated attacker to execute code that crosses the hypervisor isolation boundary, escaping from a guest virtual machine into the host (parent) partition. Exploitation requires the attacker to already have low-privileged code execution inside a guest VM on the affected host, and the high attack complexity rating indicates an additional hurdle such as a race window or a precise heap layout, so a successful overflow is not deterministic. No public exploit has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and no automatable path, though a vendor patch is available and the technical impact of a successful escape is total. Only unpatched builds below the fixed thresholds (for example Windows Server 2025 below 10.0.26100.33650 and Windows 11 24H2 below 10.0.26100.9711) are affected.
Local privilege escalation in the Microsoft Windows Search component allows an attacker who already holds low-privileged authenticated access on a Windows host to corrupt the heap and elevate to a higher-integrity context. The flaw is a heap-based buffer overflow (CWE-122) reachable only locally (AV:L) with high attack complexity (AC:H), meaning the attacker must satisfy specific memory-layout conditions, and no user interaction is required (UI:N); the component ships by default across the affected Windows 10, Windows 11, and Windows Server editions, so no optional feature must be enabled. Microsoft has released vendor patches that raise the fixed OS build numbers for each affected branch, and no public exploit has been identified at time of analysis - this is a genuine but moderate-priority local privilege-escalation issue rather than a remotely exploitable or actively attacked flaw.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds a foothold on a Windows host to escalate to SYSTEM-level privileges by triggering a heap-based buffer overflow (CWE-122). The flaw carries a CVSS 3.1 base score of 7.8 on a strictly local vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no victim interaction and no network path are required, but the attacker must already be able to run code or hold a valid session on the target. Microsoft has published fixed builds covering Windows 10, Windows 11, and Windows Server 2012 through 2025, and no public exploit has been identified at time of analysis (SSVC exploitation: none, Automatable: no); this is a credible moderate-priority privilege-escalation issue rather than a remote-exploitation emergency.
Heap-based buffer overflow in the Microsoft Internet Messaging API (IMAPI, delivered by the inetcomm component) allows an attacker who already holds a low-privileged authenticated session on a Windows host to run arbitrary code in the context of the vulnerable component. The scored vector is strictly local (AV:L, PR:L, UI:N, S:U), so a prior foothold or valid credentials on the machine are a hard prerequisite and no user interaction is required once that access exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is already available, making this a credible but not emergency-tier patching priority.
Heap-based buffer overflow in the Windows Storage component allows an authenticated, low-privileged local user to elevate privileges to kernel-level code execution across a wide range of supported Windows 10, Windows 11, and Windows Server builds. Exploitation is constrained by high attack complexity - the overflow must be triggered under a specific, non-trivial condition (consistent with a race or a precisely groomed heap state) rather than on demand - and it requires the attacker to already hold a local account on the target host, making shared multi-user systems such as terminal servers, VDI hosts, and jump boxes the most realistic risk scenario. Microsoft has released fixes, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records no exploitation and classifies the issue as not automatable, though technical impact is total once triggered (C:H/I:H/A:H).
Local privilege escalation in Windows Direct Composition - the desktop compositor subsystem shipped by default in Windows 11 24H2, 25H2 and 26H2 and in Windows Server 2025, including Server Core - lets an attacker who already holds low-privilege local access corrupt heap memory and execute code at a higher integrity level (CVSS:3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is bounded by the prerequisite of an existing authenticated foothold on the host, so this is a post-compromise escalation primitive rather than a remote entry point; the independent assessment rates it a credible but not emergency-level priority. A vendor patch is available from Microsoft, and there is no public exploit identified at time of analysis (SSVC exploitation: none) and no KEV listing.
Local privilege escalation in Windows Direct Composition allows an attacker who already holds standard, low-privilege code execution on a target host to corrupt heap memory in the desktop composition subsystem and elevate to a higher integrity level. Affected builds include Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022 and 2025 (including Server Core), all of which ship the composition component enabled by default with no non-default configuration required. No public exploit code has been identified at time of analysis, CISA's SSVC evaluation records no observed exploitation, and no EPSS estimate was supplied; because exploitation mandates an existing local, authenticated foothold and the flaw cannot be triggered remotely, it is a credible but second-tier priority relative to network-exploitable, actively attacked vulnerabilities.
Local privilege escalation in Microsoft Windows DirectComposition (CWE-122 heap-based buffer overflow) allows an attacker who already holds low-privilege code execution on a target host to corrupt heap memory inside the composition subsystem and elevate to a higher integrity level, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/PR:L/UI:N). DirectComposition is present by default across the affected Windows 10 builds 1607 through 22H2, Windows 11 23H2 through 26H2/26H1, and Windows Server 2016 through 2025, so no special feature enablement is needed - the only prerequisite is a pre-existing local, authenticated foothold with no user interaction required. Microsoft has published fixes that raise each affected branch to its patched build, and CISA's SSVC assessment records exploitation as none, with no public exploit identified at time of analysis; this is a credible but not emergency-tier priority relative to remotely reachable or actively exploited Windows flaws.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged user to corrupt kernel heap memory and gain full control of the host at SYSTEM level. Exploitation requires the attacker to already hold a foothold on the machine (CVSS AV:L/PR:L, no user interaction), so this is a post-compromise escalation primitive rather than an initial access path. Microsoft has published a vendor fix, CISA's SSVC assessment rates exploitation as 'none' with 'no' for automatable, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows exFAT file-system driver (CWE-122) allows a locally authenticated low-privileged attacker (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) to corrupt kernel heap memory and elevate privileges to SYSTEM. The attacker must already hold a local foothold and be able to get the exFAT driver to parse attacker-controlled file-system metadata, typically by mounting or accessing a crafted exFAT volume such as a removable USB device, ISO/VHD, or disk image; no separate victim interaction is required and there is no remote/network attack path. The issue affects default Windows configurations across Windows 10, Windows 11, and Windows Server releases that support exFAT. Assessment at time of analysis: no public exploit identified, no confirmed active exploitation, and no EPSS signal supplied; Microsoft has published a vendor patch via the MSRC update guide, so this is a genuine but moderate-priority privilege-escalation risk rather than an urgent fire-drill.
Heap-based buffer overflow in Windows Event Tracing (ETW) lets remote attackers execute arbitrary code with high impact to confidentiality, integrity, and availability on unpatched Windows systems, provided a victim performs a user action such as connecting to or opening attacker-controlled network content parsed by the ETW component. No authentication or prior privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but the mandatory user interaction blocks fully automated or wormable spread, consistent with CISA SSVC scoring of Automatable: no and Exploitation: none. No public exploit code or confirmed active exploitation is identified for this CVE at time of analysis, and a vendor patch is available from Microsoft.
A heap-based buffer overflow in the OpenSSH for Windows component allows an authenticated local attacker with a low-privileged account to elevate privileges on the affected host, with high attack complexity required to reliably shape the heap for exploitation. Affected systems are Windows 10, Windows 11 and Windows Server 2019/2022/2025 installations whose OpenSSH component predates Microsoft's patched builds (for example, Windows 11 24H2/25H2 <10.0.26100.9711 and <10.0.26200.9711, Windows Server 2025 <10.0.26100.33650); updated builds are not exploitable. No public exploit code has been identified at time of analysis and Microsoft has released fixes, but the 7.0 CVSS score reflects full confidentiality, integrity and availability impact if the overflow is successfully turned into code execution; this is a genuine but second-tier local privilege-escalation issue rather than a remotely wormable flaw, and there is no confirmed active exploitation (no CISA KEV listing).
A heap-based buffer overflow in the Windows Push Notifications component lets an attacker who already holds a low-privileged local foothold on a Windows host corrupt heap memory and elevate to higher-integrity code execution, with assessed high impact to confidentiality, integrity, and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local authenticated access - this is a privilege-escalation primitive that must be chained behind a separate initial-access technique, not a standalone remote entry point - but once a foothold exists it is reliable, needs no user interaction, and applies to default client and Server Core installations. Microsoft has published a vendor patch, CISA's SSVC decision framework records no known exploitation and no automatable exploitation, and no public exploit code has been identified at time of analysis.
Heap memory corruption in the Windows Servicing Stack (SSU) allows an attacker who already holds low-privileged, authenticated local access to elevate to SYSTEM-level code execution on unpatched Windows client and server builds. Triggering it requires crafted input being processed by the servicing stack, which corrupts heap memory via a heap-based buffer overflow (CWE-122) and yields total loss of confidentiality, integrity, and availability on the host. Microsoft has released vendor fixes for every affected build family via the MSRC update guide; no public exploit code has been identified at time of analysis, CISA's SSVC decision framework rates exploitation as 'none' and the issue as non-automatable, and this remains a post-compromise privilege-escalation step rather than an initial-access vector.
Local privilege escalation in the Windows Remote Desktop Protocol component lets an attacker who already holds a low-privileged interactive session on an affected host trigger a heap-based buffer overflow and execute code at SYSTEM level, with high confidentiality, integrity, and availability impact. Despite the RDP branding this is not a network-reachable flaw: the assessed vector is AV:L/PR:L/UI:N, so a pre-existing foothold with valid low-privileged credentials is mandatory, and SSVC rates it Automatable=no, meaning scripted mass exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor patches are available for the affected Windows 10, Windows 11 (through 26H2), and Windows Server 2012 through 2025 builds.
Privilege elevation in the Windows Partition Management Driver (partmgr.sys) allows an unauthorized attacker to trigger a heap-based buffer overflow and achieve high-integrity code execution with full confidentiality, integrity, and availability impact, affecting unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds below their respective fixed build numbers. The attack is network-vectored (AV:N) with low complexity and no required privileges, but exploitation is gated by user interaction (UI:R) - a victim must open, mount, or otherwise engage with attacker-supplied content that reaches the vulnerable driver code path - which is why CISA's SSVC assessment rates the flaw not automatable. No public exploit identified at time of analysis and SSVC reports no observed exploitation; vendor-released patches are available, so risk is concentrated in unpatched fleets where social engineering of the user-interaction step is plausible.
A heap-based buffer overflow in the Microsoft Windows Search Component lets an authenticated attacker with existing low-privilege code execution on a Windows host elevate to higher privileges, including SYSTEM, with no user interaction required. The flaw affects a default-present OS feature across Windows 10, Windows 11, and Windows Server 2012 through 2025, and exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) - an attacker cannot reach it remotely, so it functions as a post-compromise escalation step rather than an initial access vector. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none; not in KEV).
Local privilege escalation in the Microsoft Account component of supported Windows client and server releases lets an attacker who already holds a valid low-privileged local account turn that foothold into full system-level control through a heap memory corruption bug. The flaw is a heap-based buffer overflow (CWE-122) reachable with low privileges and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so it is a post-compromise escalation primitive rather than a remote entry point; there is no network attack path. Exploitation has not been observed: CISA's SSVC assessment records Exploitation as none and no public exploit code has been identified at time of analysis, and Microsoft has shipped a vendor patch covering all listed Windows builds, making this a genuine but non-emergency remediation priority concentrated on shared or multi-user hosts.
Heap-based buffer overflow in the Windows Event Tracing (ETW) subsystem allows a local attacker to achieve arbitrary code execution by supplying a crafted file or trace payload that a user then opens or processes. Affected builds span the modern Windows client and server families - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 - with the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) indicating no privileges are required but that the victim must be tricked into processing the malicious content, giving the attacker the victim's own privileges at high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as "none" and automatable as "no"; this is a genuine but second-tier priority, addressed by vendor-released patches rather than emergency mitigation.
Local privilege escalation in the Windows Kernel allows an authenticated, low-privileged attacker who already holds code execution on a host to corrupt kernel heap memory and obtain SYSTEM-level privileges. The root cause is a heap-based buffer overflow (CWE-122) in the kernel itself, so default installations of supported Windows client and server editions - including Server Core - are affected up to the fixed build thresholds published by Microsoft. No public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' with the attack path not automatable, so this is best treated as a post-foothold escalation primitive requiring local access (AV:L, PR:L) rather than an initial-access or remote vector.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated attacker with existing low-privileged code execution (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow (CWE-122) and gain high-confidentiality, high-integrity, high-availability SYSTEM-level control of the host. The service is enabled by default on all affected client and server editions - Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through Server 2025 - so no special configuration is needed, but the primitive cannot be reached remotely or pre-authentication; an attacker must already hold a foothold. There is no public exploit code and no confirmed active exploitation at time of analysis, and CISA SSVC rates exploitation as none with total technical impact, making this a credible but not emergency-tier priority.
Heap-based buffer overflow in the Microsoft Windows Search component allows an attacker who already holds low-privileged local code execution on a host to elevate to SYSTEM-level privileges. The flaw is reachable only locally (AV:L) and requires authentication (PR:L) with no victim interaction (UI:N), making it a privilege-escalation primitive rather than a remote entry point; it would typically be chained after an initial foothold. Microsoft has released vendor patches and no public exploit code or active exploitation has been identified at time of analysis. This is a credible but not emergency-level priority: the default-enabled Search component is present on a broad range of Windows client and server builds, but exploitation is gated on a pre-existing local foothold.
Local privilege escalation in the Windows MIDI Service Module allows an authenticated attacker with low-level privileges (PR:L) on an affected Windows 11 host to corrupt heap memory and elevate to SYSTEM-level or otherwise higher-integrity execution. The flaw is a CWE-122 heap-based buffer overflow (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) triggered by malformed input delivered to the MIDI service interface; it is local-only, requires an existing foothold, and involves no victim user interaction. There is no public exploit identified at time of analysis and CISA's SSVC assessment records no exploitation, so this is a credible but not emergency-tier vulnerability - patch when convenient within normal monthly cycles rather than on an emergency basis. Affected builds are Windows 11 24H2, 25H2, 26H2, and 26H1 below their respective patched builds (10.0.26100.9711, 10.0.26200.9711, 10.0.26300.9711, 10.0.28000.3231).
Local privilege escalation in the Windows Bluetooth Port Driver lets an authenticated user who already holds a foothold on a Windows host trigger a heap-based buffer overflow and reach high-integrity code execution, scored CVSS 7.0 with total confidentiality, integrity, and availability impact. The defect (CWE-122) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 builds that predate the current cumulative updates, is not remotely reachable, and requires local access with low privileges, no user interaction, and high attack complexity (AV:L/AC:H/PR:L/UI:N). Microsoft has released a vendor patch, CISA's SSVC decision framework records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis - this is a genuine but second-tier priority behind remotely reachable or confirmed-exploited issues.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.