Heap Overflow
Monthly
Heap memory corruption in the Windows SMB Client lets a remote, unauthenticated attacker escalate privileges on any affected Windows 10, Windows 11, or Windows Server host after the victim is induced to open an SMB connection to an attacker-controlled server. The vulnerability carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no attacker credentials are needed but the victim must initiate the outbound SMB session, since the flaw sits in the client's parsing path rather than in a listening service. Microsoft has published fixed builds via the MSRC update guide, exploitation has not been observed, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with automation as impractical - making this a credible mid-to-high priority patch item rather than an emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow and escalate to SYSTEM, yielding full loss of confidentiality, integrity, and availability (CVSS 7.8). The vulnerability is reachable only with local access and low privileges (AV:L, PR:L, UI:N) and requires no user interaction, making it a post-compromise escalation primitive rather than an initial-access or network-facing attack path. No public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none and Automatable: no), but Microsoft has published vendor fixes covering Windows 10, Windows 11, and Windows Server builds, so unpatched hosts where an attacker has already landed should be treated as high risk.
Remote code execution in Microsoft Windows Shell (CVE-2026-83782) lets an unauthenticated attacker trigger a heap-based buffer overflow and run arbitrary code, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - no privileges, no user interaction and no non-default configuration are required per the assessed vector. The flaw affects Windows client editions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Windows Server 2025, so essentially every supported and several legacy Windows builds are in scope until patched. No public exploit code identified at time of analysis, and CISA's SSVC assessment records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, meaning the urgency driver today is patch coverage rather than observed attacks. CISA KEV does not list this CVE, so there is no confirmation of active exploitation.
Heap-based buffer overflow in Microsoft Windows Installer (msiexec) allows an authenticated local attacker with low privileges to elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server releases. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is reachable only after a local foothold is obtained, making it a post-compromise escalation primitive rather than a remote entry point. At time of analysis, no public exploit code or confirmed active exploitation has been reported, and Microsoft has released patched builds.
Remote code execution in Microsoft's Internet Messaging API affects unpatched Windows 10, Windows 11, and Windows Server installations, where a heap-based buffer overflow lets an unauthenticated attacker execute code by delivering a specially crafted message. Exploitation is network-reachable without credentials (AV:N, PR:N), but the victim must open or preview the malicious content (UI:R), so unattended services are not directly triggerable, and success yields full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment records Exploitation: none with Automatable: no, though Technical Impact is rated total - making this a credible, high-priority patching target rather than an emergency.
Privilege escalation in the Windows Bluetooth Service lets an attacker within Bluetooth radio range trigger a heap-based buffer overflow and gain full control over the confidentiality, integrity, and availability of the target host, as reflected in the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.8). No authentication and no user interaction are required; a reachable, Bluetooth-enabled endpoint in default configuration is sufficient, which makes this a genuinely serious but not emergency-tier issue because the flaw cannot be triggered over the internet or a routed network - CISA's SSVC decision framework accordingly rates it non-automatable with exploitation observed as none. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to gain SYSTEM-level access by triggering an unsynchronized access to a shared resource during MSI package operations. Exploitation requires a valid local account (PR:L, AV:L) and hinges on winning a narrow timing window (AC:H), so attacks are typically unreliable and may need many repeated attempts - consistent with CISA SSVC rating the issue not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent, so real-world urgency is lower than the HIGH-adjacent, 7.0 CVSS score alone might suggest; vendor patches are available for all affected Windows builds.
Heap-based buffer overflow in the Windows Text Shaping engine (CWE-122) allows unauthenticated remote attackers to execute arbitrary code, carrying a critical CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity, and availability impact. Affected systems span an unusually wide footprint of Windows client and server releases - Windows 10 21H2/22H2 and 1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - but only unpatched builds below the fixed versions catalogued by ENISA EUVD are exposed. Microsoft has released vendor patches through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; because the assessed vector asserts no authentication and no user interaction, defenders should confirm the UI:N rating against the MSRC advisory, since text-shaping code paths are normally reached only when attacker-supplied content is actually rendered.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows Win32K kernel-mode driver (win32kbase.sys/win32kfull.sys) lets an attacker who already holds a low-privileged local session on a Windows host corrupt kernel pool memory and elevate to SYSTEM-level privileges. The flaw is rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and affects Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations below the patched build numbers. Exploitation is not remote and requires pre-existing local access, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Microsoft has issued a fix, making this a credible, patch-worthy local privilege-escalation issue rather than an emergency on its own.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Heap-based buffer overflow in Windows Image Acquisition (WIA) allows an unauthenticated remote attacker to execute arbitrary code on Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 systems, but only after the victim opens or processes a specially crafted image through the WIA component (UI:R), so exploitation requires user interaction rather than being zero-click. CVSS 3.1 scores this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H / CWE-122), CISA's SSVC rates it Automatable: no with total technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available from Microsoft, making this a high-priority patch-now issue for unpatched builds rather than an emergency driven by active exploitation.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
A heap-based buffer overflow in the Windows RPC Runtime lets an authenticated local attacker with standard user rights elevate to higher privileges on affected Windows 11 hosts. The flaw is only reachable by code already executing on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and the vulnerable component is core, always-present Windows infrastructure, so no special configuration or user interaction is needed once a foothold exists. Microsoft has released fixes in its update guide (MSRC advisory for CVE-2026-83518), and there is no public exploit identified at time of analysis (SSVC exploitation: none, CISA KEV not listed); this makes it a patch-priority item for fleets still running unpatched Windows 11 builds rather than an emergency.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Heap-based buffer overflow in Microsoft's optional MPEG-2 Video Extension (versions 1.0.0.0 up to but not including 1.2.32.0) allows an unauthenticated attacker to execute code over a network by delivering a specially crafted MPEG-2 media file that a victim opens in an application that invokes the codec. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a total technical impact offset by a required user interaction: the codec is a deliberate Microsoft Store add-on rather than a default Windows component, so the exposed population is limited to systems where it has been installed, and code executes only in the context of the user who opens the file. CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, and no public exploit has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.
Heap-based buffer overflow in the Microsoft Windows WebDAV client (WebClient service / WebDAV redirector) allows an unauthenticated remote attacker to corrupt heap memory and potentially achieve code execution on affected Windows hosts, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by mandatory user interaction: the victim must be induced to connect to or open attacker-controlled WebDAV content, such as a malicious WebDAV server, a UNC/WebDAV path, or a document containing an embedded remote reference. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation=none and Automatable=no, so this is a high-priority patch candidate rather than an emergency; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.
A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.
Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.
Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.
Local privilege escalation in the Windows Kernel allows a low-privileged, authenticated attacker who already holds code execution on a target host to trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM-level privileges. The vulnerability is strictly local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it provides no remote or network path and is only useful as a post-compromise escalation step rather than an initial access vector. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with 'Automatable: no', because the attacker must already have a local foothold; Microsoft has published patched builds for the affected Windows 11 and Windows Server releases.
Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.
A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.
Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.
Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.
Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.
Heap memory corruption in the Windows SMB Client lets a remote, unauthenticated attacker escalate privileges on any affected Windows 10, Windows 11, or Windows Server host after the victim is induced to open an SMB connection to an attacker-controlled server. The vulnerability carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no attacker credentials are needed but the victim must initiate the outbound SMB session, since the flaw sits in the client's parsing path rather than in a listening service. Microsoft has published fixed builds via the MSRC update guide, exploitation has not been observed, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with automation as impractical - making this a credible mid-to-high priority patch item rather than an emergency.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow and escalate to SYSTEM, yielding full loss of confidentiality, integrity, and availability (CVSS 7.8). The vulnerability is reachable only with local access and low privileges (AV:L, PR:L, UI:N) and requires no user interaction, making it a post-compromise escalation primitive rather than an initial-access or network-facing attack path. No public exploit code has been identified at time of analysis (CISA SSVC records Exploitation: none and Automatable: no), but Microsoft has published vendor fixes covering Windows 10, Windows 11, and Windows Server builds, so unpatched hosts where an attacker has already landed should be treated as high risk.
Remote code execution in Microsoft Windows Shell (CVE-2026-83782) lets an unauthenticated attacker trigger a heap-based buffer overflow and run arbitrary code, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - no privileges, no user interaction and no non-default configuration are required per the assessed vector. The flaw affects Windows client editions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Windows Server 2025, so essentially every supported and several legacy Windows builds are in scope until patched. No public exploit code identified at time of analysis, and CISA's SSVC assessment records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, meaning the urgency driver today is patch coverage rather than observed attacks. CISA KEV does not list this CVE, so there is no confirmation of active exploitation.
Heap-based buffer overflow in Microsoft Windows Installer (msiexec) allows an authenticated local attacker with low privileges to elevate to SYSTEM on affected Windows 10, Windows 11, and Windows Server releases. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is reachable only after a local foothold is obtained, making it a post-compromise escalation primitive rather than a remote entry point. At time of analysis, no public exploit code or confirmed active exploitation has been reported, and Microsoft has released patched builds.
Remote code execution in Microsoft's Internet Messaging API affects unpatched Windows 10, Windows 11, and Windows Server installations, where a heap-based buffer overflow lets an unauthenticated attacker execute code by delivering a specially crafted message. Exploitation is network-reachable without credentials (AV:N, PR:N), but the victim must open or preview the malicious content (UI:R), so unattended services are not directly triggerable, and success yields full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment records Exploitation: none with Automatable: no, though Technical Impact is rated total - making this a credible, high-priority patching target rather than an emergency.
Privilege escalation in the Windows Bluetooth Service lets an attacker within Bluetooth radio range trigger a heap-based buffer overflow and gain full control over the confidentiality, integrity, and availability of the target host, as reflected in the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.8). No authentication and no user interaction are required; a reachable, Bluetooth-enabled endpoint in default configuration is sufficient, which makes this a genuinely serious but not emergency-tier issue because the flaw cannot be triggered over the internet or a routed network - CISA's SSVC decision framework accordingly rates it non-automatable with exploitation observed as none. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and Microsoft has published patched builds for all affected Windows 10, Windows 11, and Windows Server releases.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to gain SYSTEM-level access by triggering an unsynchronized access to a shared resource during MSI package operations. Exploitation requires a valid local account (PR:L, AV:L) and hinges on winning a narrow timing window (AC:H), so attacks are typically unreliable and may need many repeated attempts - consistent with CISA SSVC rating the issue not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS/KEV signals are absent, so real-world urgency is lower than the HIGH-adjacent, 7.0 CVSS score alone might suggest; vendor patches are available for all affected Windows builds.
Heap-based buffer overflow in the Windows Text Shaping engine (CWE-122) allows unauthenticated remote attackers to execute arbitrary code, carrying a critical CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity, and availability impact. Affected systems span an unusually wide footprint of Windows client and server releases - Windows 10 21H2/22H2 and 1809, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) - but only unpatched builds below the fixed versions catalogued by ENISA EUVD are exposed. Microsoft has released vendor patches through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; because the assessed vector asserts no authentication and no user interaction, defenders should confirm the UI:N rating against the MSRC advisory, since text-shaping code paths are normally reached only when attacker-supplied content is actually rendered.
Local privilege escalation in the Windows Kernel (heap-based buffer overflow, CWE-122) allows an attacker who already holds low-privileged, authenticated code execution on a host to corrupt kernel pool memory and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local-only with no user interaction required (AV:L/AC:L/PR:L/UI:N), so this is a post-compromise elevation primitive rather than a remote entry point, and because the flaw sits in a core kernel component, default installations of the affected builds are exposed with no special feature or non-default configuration required. Microsoft has published fixed builds through its update guide, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' with a total technical impact, so this is a genuine but not emergency-priority issue.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an authenticated local attacker to execute code on the affected Windows host, earning a 7.8 score under CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The flaw is not remotely reachable - exploitation requires that the attacker already hold low-level authenticated access and the ability to run code on the target and then drive the error-reporting component with crafted input, making this a post-compromise privilege-escalation primitive rather than an initial-access vector. Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, and no public exploit code has been identified at time of analysis; the assessed priority is credible but not emergency-tier, and it should be treated as a patch-cycle item rather than an out-of-band emergency.
Heap-based buffer overflow in the Windows Win32K kernel-mode driver (win32kbase.sys/win32kfull.sys) lets an attacker who already holds a low-privileged local session on a Windows host corrupt kernel pool memory and elevate to SYSTEM-level privileges. The flaw is rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity and availability impact) and affects Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 including Server Core installations below the patched build numbers. Exploitation is not remote and requires pre-existing local access, so it functions as a post-compromise privilege-escalation step rather than an initial-access vector; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). Microsoft has issued a fix, making this a credible, patch-worthy local privilege-escalation issue rather than an emergency on its own.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Local privilege escalation in the Windows Camera Frame Server Monitor component allows an attacker who already holds a low-privileged authenticated session on an unpatched Windows host to corrupt heap memory and elevate to SYSTEM-level code execution. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction, but it is strictly local - there is no network-facing exposure and a pre-existing foothold is mandatory, making this a post-compromise escalation step rather than an initial-access vector. Microsoft has released patches (MSRC update guide for CVE-2026-83753); no public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and the issue as not automatable, so this is a serious but second-tier priority compared with remotely reachable flaws.
Local privilege escalation in Windows Error Reporting (WER) allows an authenticated attacker who already holds a low-privileged session on a Windows host to win a time-of-check-time-of-use race and corrupt heap memory, potentially escalating to SYSTEM-level code execution. Affected builds span Windows 10, Windows 11 (23H2 through 26H1/26H2), and Windows Server 2012 through Windows Server 2025, including Server Core installations. There is no public exploit identified at time of analysis and no confirmed active exploitation - CISA's SSVC records Exploitation 'none' and Automatable 'no' - and the High attack complexity reflects the non-deterministic race window, which requires repeated attempts to land reliably.
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) enables unauthenticated remote code execution across a wide range of Windows 10, Windows 11, and Windows Server builds, per a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N). The vector indicates no authentication or user interaction is required and impact is total (C:H/I:H/A:H), but the exact network-facing entry point to WER is not specified in the available data and should be verified against the MSRC advisory, as WER is often a local component. No public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in the Microsoft Windows Search Component enables unauthenticated remote attackers to achieve arbitrary code execution, though exploitation requires victim user interaction (UI:R) to open, preview, or index attacker-controlled content. This affects default configurations across supported Windows client and server editions, including Server Core installations, and vendor patched builds are available. No public exploit code has been identified at time of analysis, and the SSVC assessment lists exploitation as none and automatable as no.
Local privilege escalation in Windows Management Instrumentation (WMI) allows an attacker who already holds a low-privileged, authenticated session on a Windows host to corrupt heap memory and escalate to SYSTEM-level privileges. The flaw is a heap-based buffer overflow (CWE-122) reachable through the WMI code path that ships enabled by default on every supported Windows client and Windows Server build, from Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2 up to Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. Microsoft has released a vendor patch and no public exploit has been identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, reflecting the high attack complexity and unpredictable heap state required for reliable exploitation. The issue is a real but opportunistic escalation primitive rather than a wormable or remotely reachable bug.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local privilege escalation in Windows NTLM lets an attacker who already holds low-privileged, authenticated code execution on a Windows host corrupt heap memory and gain higher privileges (CVSS 7.8, CWE-122). The flaw is reachable without user interaction and on default installations, and because NTLM is a default, always-present Windows component, every client and server build listed by the vendor (Windows 10/11 and Windows Server 2016 through 2025) is affected. Exploitation is not confirmed actively exploited (no CISA KEV entry) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment scores exploitation as none while flagging the technical impact on a successfully exploited system as total, so patching should be handled in a normal Patch Tuesday cadence rather than as an emergency.
A heap-based buffer overflow in the Windows Client-Side Caching (CSC) service - the component behind Offline Files - lets an attacker who already holds low-privileged local code execution on a Windows host corrupt heap memory and elevate to SYSTEM privileges. Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025, including Server Core installations, with vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and Microsoft-rated patch availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and the local attack vector means this is a post-compromise privilege-escalation primitive rather than an initial-access vector.
Heap-based buffer overflow in Windows Error Reporting (WER) lets a remote, unauthenticated attacker execute arbitrary code with no user interaction on unpatched Windows 10, Windows 11, and Windows Server builds, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A:H); SSVC scores it automatable with total technical impact, though exploitation has not been observed. Microsoft has released vendor patches that raise affected builds to fixed levels (for example Windows 11 24H2 to 10.0.26100.9711, Server 2022 to 10.0.20348.5761, and Windows 10 1809/Server 2019 to 10.0.17763.9376), so exposure is confined to systems still below those revision thresholds. The practical precondition is network reachability of the WER attack surface: because WER is historically a local component, the exact remotely exposed endpoint should be confirmed against the MSRC advisory before assuming default network exploitability, and no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Bind Filter Driver (bindflt), a kernel-mode component shipped by default on supported Windows client and server editions, lets a locally authenticated user with only low privileges corrupt kernel heap memory and escalate to SYSTEM. Exploitation requires existing local access and a valid low-privileged account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the bug functions as a privilege-escalation stage chained after an initial foothold rather than an independent remote entry point; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Microsoft has published fixed builds for all affected branches, so despite the lack of exploitation telemetry this is a genuine patch-priority item for Windows environments.
Local privilege escalation in the Windows DHCP Server role (CWE-122 heap-based buffer overflow, CVSS 7.8) allows an attacker who already holds a low-privileged, authorized local account on a server running the DHCP role to corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity, and availability. Exploitation is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) and is low complexity (AC:L), so a foothold on a DHCP host is the principal prerequisite; DHCP Server is an optional role and is not present on default client installations, which limits exposure. Microsoft has released fixes and no public exploit has been identified at time of analysis - CISA SSVC rates exploitation as none, and the issue is not listed in KEV, so this is a genuine but non-urgent post-compromise escalation issue rather than an urgent remote threat.
Heap-based buffer overflow in Microsoft's Windows Remote Desktop Client (mstsc.exe) lets an unauthorized remote attacker execute code over a network when a victim connects outbound to a malicious or compromised RDP server, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8). Because the vulnerable component is the client rather than a listening service, exploitation is not automatable against passive hosts - it hinges on user action such as opening a crafted .rdp file or following a malicious connection prompt, which is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has published fixes and no public exploit code has been identified at time of analysis; the issue is a high-priority patching item but not an emergency drop-everything event.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an attacker who already holds low-privileged authenticated access to a Windows host to corrupt the heap of the SYSTEM-level installer service and gain elevated code execution. The flaw is rated CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): it is strictly local and authenticated, and the high attack-complexity metric reflects that successful exploitation hinges on conditions the attacker does not fully control, such as winning a heap layout or timing race, so reliable exploitation is difficult. No public exploit code was identified at time of analysis, and CISA's SSVC evaluation records Exploitation as none and Automatable as no; every supported Windows client and server edition (including Server Core) at builds below the vendor's fixed levels is affected, and a vendor patch is available.
Heap-based buffer overflow in the Windows TCP/IP stack allows an attacker who already holds authenticated low-privileged local access to elevate to SYSTEM-level privileges on the affected host. Exploitation is confined to unpatched builds within the published version ranges (for example Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650), requires no user interaction (CVSS AV:L/AC:L/PR:L/UI:N), and is not assessed as automatable by CISA SSVC. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Microsoft has released vendor patches; this is a credible but not emergency-level priority given the mandatory pre-existing local foothold.
Local privilege escalation in Microsoft Windows Installer lets an attacker who already holds a low-privileged authenticated account on a Windows host raise their privileges to SYSTEM or administrative level by triggering a heap-based buffer overflow (CWE-122) that stems from an integer underflow during MSI package processing. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2022, and Windows Server 2025 including Server Core, while fully patched builds such as Windows 11 24H2 10.0.26100.9711 and Windows Server 2022 10.0.20348.5761 are not vulnerable. Scoring is 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): the attacker needs local access and an existing low-privilege account but no user interaction, and the high attack complexity (AC:H) reflects timing or memory-layout conditions that are not reliably under the attacker's control. There is no CISA KEV entry and no public exploit code identified at time of analysis, and CISA SSVC rates exploitation as none and the flaw as not automatable, so realistic risk sits below the raw 7.0 for most environments.
Heap-based buffer overflow in the Windows NTFS filesystem driver lets an authenticated local user elevate privileges on the affected host. Exploitation requires pre-existing local code execution as at least a standard user (CVSS vector AV:L/PR:L/UI:N, CWE-122), so this is a post-compromise escalation primitive rather than a remote or initial-access vector - nothing here can be triggered across the network or through a browser, and no special feature toggle is needed because the NTFS driver is loaded and active by default on every listed Windows 10, Windows 11 and Windows Server 2012 through 2025 build, including Server Core installations. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis, but given the ubiquity of the component and the kernel memory-corruption class, this warrants prompt patching on any host where low-privileged users can run code.
Heap-based buffer overflow in the Windows Media component of supported Windows editions lets a locally authenticated, low-privileged user (or code already running at low integrity) corrupt heap memory and escalate to SYSTEM-level privileges by supplying a crafted media file to the affected component. Per the assessed vector (AV:L/PR:L/UI:N), exploitation is local only, requires a prior foothold, and cannot be triggered remotely or by an unauthenticated attacker, so it functions as a second-stage privilege-escalation primitive rather than a remote entry point. No public exploit code has been identified at time of analysis, CISA SSVC records no observed exploitation, and vendor patches addressing every affected Windows build are available.
Local privilege escalation in the Windows Media component allows an authenticated attacker with low privileges (CVSS AV:L/AC:L/PR:L/UI:N) to trigger a heap-based buffer overflow and gain high-integrity code execution, giving full compromise of confidentiality, integrity, and availability on the host. The flaw is not remotely reachable and requires a pre-existing foothold on an unpatched build, so it is a second-stage escalation vector rather than an initial-access path; all supported Windows 10, Windows 11, and Windows Server branches below their respective fixed build numbers are affected. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none', so this is a legitimate but non-emergency patch priority - vendor patches are available.
Local code execution in the Windows NTFS filesystem implementation allows an attacker who already holds a low-privileged local account to corrupt heap memory in the kernel and elevate to full system-level code execution. All supported Windows client and server builds are affected, including Windows 10, Windows 11 (23H2 through 26H2), Windows Server 2012 through 2025, and their Server Core installations; exploitation requires existing local access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, so exposure is concentrated on multi-user, RDP/VDI, and already-compromised hosts. Patch status is available from the vendor, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Local privilege escalation in the Windows Sensor Data Service lets an authenticated, low-privileged attacker who already holds code execution on a host corrupt the service's heap and run code in its higher-integrity context. The defect is a heap-based buffer overflow (CWE-122) tracked at CVSS 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, making it a post-compromise escalation step rather than a remote or initial-access vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has published fixes covering the affected build ranges.
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Heap-based buffer overflow in the Windows USB Driver allows an authenticated local attacker with low-privileged code execution to elevate privileges to SYSTEM on affected Windows systems. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server editions, but exploitation requires a pre-existing local foothold and no remote vector is possible (CVSS AV:L, PR:L, UI:N). Microsoft has released patched builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the SSVC decision framework rates exploitation as none with total technical impact, making this a credible but not emergency-priority local privilege-escalation issue.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged local session to trigger a heap-based buffer overflow (CWE-122) and elevate to higher-integrity code execution, with high impact to confidentiality, integrity, and availability (CVSS 7.0). The vulnerable component is the service behind Offline Files, which ships and runs by default across Windows 10, Windows 11, and Windows Server releases, so any multi-user or shared-access endpoint with an existing local foothold is in scope. Exploitation requires local access (AV:L) and a high-complexity trigger (AC:H) - typically a race or precise heap-grooming precondition - so reliable attacks remain difficult; there is no public exploit identified at time of analysis, no KEV listing, and CISA's SSVC assessment records exploitation as none and automatable as no. Microsoft has released vendor patches, and the raw 7.0 score should be weighted against the pre-existing foothold and high-complexity precondition, placing this at moderate priority rather than emergency patching.
Local privilege escalation in the Windows Smart Card component affects unpatched Windows 10, Windows 11, and Windows Server 2012 through 2025 builds, allowing an attacker who already holds an authenticated local session with low-level privileges to overflow a heap buffer and elevate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); it is not remotely reachable, requires no user interaction, and Microsoft rates exploitation as non-automatable. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV and SSVC both report none), so this is a moderate-priority local privilege escalation that should be remediated through routine patching rather than emergency response, while noting that the technical impact if successfully triggered is total (confidentiality, integrity, and availability of the host).
Unauthenticated remote code execution in Windows PowerShell allows a network attacker to trigger a heap memory corruption via an integer wraparound in PowerShell's allocation logic, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Every supported Windows client and server build from Windows 10 1607, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025 (including Server Core installations) is affected unless updated to the fixed builds published in the Microsoft advisory, so exposure is effectively OS-wide rather than tied to a niche component. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); however, SSVC marks it Automatable with total technical impact, so exploitation pressure should be treated as high and remediation prioritized.
Local privilege escalation in the HID Parser Library shipped with Windows lets an attacker who already holds authenticated low-privilege access corrupt heap memory and run code at a higher integrity level through a malformed HID descriptor processed by the default-enabled HID stack. Assessed CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122); the attack is local-only, requires existing low-privilege access and the ability to supply a crafted descriptor (local user context or a malicious/emulated USB or Bluetooth HID peripheral), with no user interaction and low complexity. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with total technical impact, and a vendor patch is available; this is a credible but not emergency-level priority, so remediation should follow the normal monthly patch cadence.
Heap-based buffer overflow in Windows Image Acquisition (WIA) allows an unauthenticated remote attacker to execute arbitrary code on Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 systems, but only after the victim opens or processes a specially crafted image through the WIA component (UI:R), so exploitation requires user interaction rather than being zero-click. CVSS 3.1 scores this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H / CWE-122), CISA's SSVC rates it Automatable: no with total technical impact, and no public exploit has been identified at time of analysis. Vendor patches are available from Microsoft, making this a high-priority patch-now issue for unpatched builds rather than an emergency driven by active exploitation.
Heap-based buffer overflow in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server builds by sending crafted input that corrupts heap memory in the reporting component. Microsoft rates the vulnerability as critical (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no credentials or user interaction are required, although exploitation depends on whether a given host exposes a network-reachable error-reporting path - WER is typically local telemetry, so default or firewalled deployments may not be reachable. There is no public exploit identified at time of analysis and CISA's SSVC assessment lists exploitation as none (automatable: yes, technical impact: total); a vendor patch is available from Microsoft, and hosts updated to the fixed builds listed for their release are not exploitable.
A heap-based buffer overflow in the Windows RPC Runtime lets an authenticated local attacker with standard user rights elevate to higher privileges on affected Windows 11 hosts. The flaw is only reachable by code already executing on the machine (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and the vulnerable component is core, always-present Windows infrastructure, so no special configuration or user interaction is needed once a foothold exists. Microsoft has released fixes in its update guide (MSRC advisory for CVE-2026-83518), and there is no public exploit identified at time of analysis (SSVC exploitation: none, CISA KEV not listed); this makes it a patch-priority item for fleets still running unpatched Windows 11 builds rather than an emergency.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) lets remote attackers execute arbitrary code in the context of the process that parses attacker-supplied media, affecting a wide swath of supported Windows 10, Windows 11, Windows Server 2012 through 2025, and Server Core builds. Our independent assessment rates the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no authentication is required (PR:N) but the victim must typically open, play, or preview the malicious media file or stream, so the input's UI:N rating overstates practical reachability and delivery depends on social engineering or an application that auto-processes untrusted media. No public exploit and no CISA KEV listing have been identified at time of analysis, though the flaw is classified as automatable with total technical impact, and vendor patches are available.
Local privilege escalation in the Windows Partition Management Driver lets an attacker who already holds a low-privileged local foothold on the host trigger a heap-based buffer overflow in kernel mode and gain full SYSTEM-level code execution. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no network surface are involved - the only prerequisite is authenticated local access and the ability to issue crafted I/O to the driver, which ships by default on every affected Windows build. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a post-compromise escalation and not an initial-access vector; a vendor patch is available.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows a standard user who can get a malformed UDF volume parsed by the kernel to corrupt and then reuse freed heap memory, escaping the sandbox and running code as SYSTEM. Exploitation requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no user interaction, but there is no network vector and the attacker must already hold a foothold capable of executing code and triggering UDF parsing. Microsoft has released patched builds via the MSRC update guide; there is no public exploit identified at time of analysis, no evidence of active exploitation (CISA SSVC exploitation: none), and the issue is best handled as a normal patch-cycle priority rather than an emergency.
Heap-based buffer overflow in Microsoft Internet Information Services (IIS) on affected Windows builds allows a locally authenticated, low-privileged attacker to elevate privileges to a higher-integrity context, with total technical impact assessed (C:H/I:H/A:H). The issue is reachable only from local access on a host where the IIS role is installed and unpatched - it is not network-exploitable and requires an existing foothold on the machine - so it functions as a post-compromise escalation step rather than a mass-exploitable entry point, and SSVC rates it non-automatable with no observed exploitation. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected Windows Server 2012 through 2025 and Windows 10/11 builds.
Heap-based buffer overflow in Microsoft Office Excel allows unauthenticated remote attackers to execute arbitrary code when a victim opens a specially crafted Excel document, affecting Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, Microsoft 365 Apps for Enterprise, and corresponding Mac editions. Exploitation requires user interaction (opening a malicious file) and no public exploit or active exploitation is currently identified, per SSVC (Exploitation: none). Vendor patches are available, and code execution occurs only with the privileges of the user who opens the file.
Heap-based buffer overflow in the Windows Imaging Component (WIC) allows unauthenticated attackers to execute arbitrary code when a victim opens or previews a specially crafted image file (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Because WIC is a default Windows component, every affected build from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through Server 2025 is potentially exposed, although the mandatory user interaction (UI:R) means delivery depends on social engineering and CISA SSVC records Automatable=no. No public exploit code and no active exploitation have been identified at time of analysis, and Microsoft has published a vendor patch through its update guide. This is a credible high-priority patching item rather than an emergency, driven by total technical impact (C:H/I:H/A:H) but gated by required user interaction.
Heap-based buffer overflow in Microsoft's optional MPEG-2 Video Extension (versions 1.0.0.0 up to but not including 1.2.32.0) allows an unauthenticated attacker to execute code over a network by delivering a specially crafted MPEG-2 media file that a victim opens in an application that invokes the codec. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects a total technical impact offset by a required user interaction: the codec is a deliberate Microsoft Store add-on rather than a default Windows component, so the exposed population is limited to systems where it has been installed, and code executes only in the context of the user who opens the file. CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, and no public exploit has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in Microsoft Word lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens a specially crafted document, affecting Office LTSC 2021 and LTSC 2024, Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. Because the flaw triggers only when the victim opens the malicious file (CVSS UI:R) and SSVC marks it non-automatable, exploitation depends on social engineering rather than automated mass attacks, even though a successful hit yields total loss of confidentiality, integrity and availability (CVSS 8.8). A vendor patch is available; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Word allows remote code execution when a user opens or previews a specially crafted document. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 on Windows, and Office LTSC for Mac 2021/2024 plus Office 365 for Mac, with a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and total technical impact per CISA's SSVC. Exploitation requires the victim to open the malicious document (UI:R), so it is not reachable through passive network traffic or automated scanning, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; vendor patches are available and should be prioritized given the high impact.
Heap-based buffer overflow in Microsoft Outlook allows an unauthenticated remote attacker to execute code over a network by delivering a crafted email message that Outlook processes during parsing or rendering. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) asserts no privileges and no user interaction, implying a zero-click/preview-pane trigger against default configurations; the impact is scoped to installations running the vulnerable builds of Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 365 for Mac, and Office LTSC for Mac 2021/2024. CISA's SSVC assessment reports Exploitation: none and no public exploit code has been identified at time of analysis, but the issue is rated Automatable: yes with Technical Impact: total, and a vendor patch is available - this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Heap-based buffer overflow in Microsoft Word allows remote attackers to execute code in the context of the user who opens a crafted Word document. Exploitation requires the victim to open an attacker-supplied file (CVSS UI:R) and no authentication or prior privileges (PR:N), with code running only in the opening user's context and no privilege escalation (S:U); SSVC marks the attack non-automatable, and no public exploit has been identified at time of analysis. Vendor patches are available, including fixed builds for Office LTSC 2021 and LTSC 2024, with updates for Mac and Microsoft 365 Apps distributed through Microsoft's Office security release channel.
Local privilege escalation in the Windows Win32K GRFX graphics subsystem lets an attacker who already holds a low-privileged local foothold trigger a heap-based buffer overflow in kernel-mode graphics code and escalate to SYSTEM. All supported Windows client and server editions that ship the affected Win32K components are in scope, including Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; no user interaction is required and no non-default configuration is needed. Microsoft has released fixed builds, and while technical impact is rated total, there is no confirmed active exploitation and no public exploit code identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or wormable threat.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem (Win32k) allows a locally authenticated attacker to elevate privileges on affected Windows systems. Successful exploitation yields full control of the kernel - confidentiality, integrity and availability impacts are all High (CVSS 7.8, AV:L/PR:L/UI:N) - meaning an attacker who already has low-privileged code execution can escalate to SYSTEM, typically to disable protections or install persistence. The prerequisites are significant: the attacker must already hold local access and valid credentials, and there is no remote vector; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), though CISA's SSVC assessment rates the potential technical impact as total. Affected builds span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2016-2025, so patch prioritization belongs in the standard monthly Windows cumulative-update cycle rather than emergency response.
Heap-based buffer overflow in Microsoft Office Outlook (CWE-122) lets a remote, unauthenticated attacker execute arbitrary code in the context of the Outlook process by delivering a specially crafted message or object that the victim must open or render. Affected builds per EUVD-2026-99711 are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 below 16.0.14334.20974, and Microsoft Office LTSC 2024 below 16.0.17932.21056; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction being the only meaningful barrier. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, and SSVC records Exploitation=none with Automatable=no, so this is a credible mid-to-high priority client-side issue rather than an emergency; no EPSS score was supplied in the feed, so no probabilistic exploitation estimate can be cited.
Local privilege escalation in Microsoft Windows Media Foundation allows an attacker who already holds a low-privileged, authenticated local account to drive the media decoding pipeline into a heap-based buffer overflow and corrupt memory in a higher-privileged context. The issue is rated 7.8 (AV:L/AC:H/PR:L/UI:N, scope unchanged in our independent assessment) and per that vector is neither remote nor unauthenticated, and needs no victim interaction - the practical barriers are the local-access prerequisite and the high attack complexity of controlling the heap layout. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this is a genuine patch-priority item rather than an emergency; vendor patches are available per Microsoft's update guide.
Heap-based buffer overflow in Microsoft Word allows unauthenticated remote attackers to execute arbitrary code when a crafted document is parsed, though exploitation is difficult to trigger reliably (AC:H) and, per our assessment, requires the victim to open or preview the malicious file (UI:R). Microsoft's advisory vector lists UI:N (no user interaction), which would suggest an automatic preview-pane path; this discrepancy should be resolved with MSRC because UI:R materially lowers real-world exploitability. A vendor patch is available for all affected Office channels, no public exploit code or CISA KEV entry was identified at time of analysis, and SSVC marks the flaw non-automatable, making this a serious but not emergency-tier vulnerability.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and corresponding Office for Mac editions when a victim opens a specially crafted document that triggers a heap-based buffer overflow. The attacker is unauthenticated (PR:N), but exploitation requires user interaction (UI:R), and any code runs in the context of the opening user (S:U) without crossing a privilege boundary. Microsoft has released patches; no public exploit identified at time of analysis, so treat this as a high-priority phishing-borne update item rather than a remotely triggerable no-interaction emergency.
Heap-based buffer overflow in the Microsoft Windows WebDAV client (WebClient service / WebDAV redirector) allows an unauthenticated remote attacker to corrupt heap memory and potentially achieve code execution on affected Windows hosts, yielding high confidentiality, integrity, and availability impact. Exploitation is gated by mandatory user interaction: the victim must be induced to connect to or open attacker-controlled WebDAV content, such as a malicious WebDAV server, a UNC/WebDAV path, or a document containing an embedded remote reference. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation=none and Automatable=no, so this is a high-priority patch candidate rather than an emergency; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft Windows Media Foundation (CWE-122) allows a remote, unauthenticated attacker to achieve arbitrary code execution in the context of the affected process when a victim opens, plays, or even previews an attacker-crafted media file; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8) confirms no privileges are required but that successful exploitation depends on the target rendering the malicious media. Every supported Windows client and server build below the patched build thresholds in this advisory is affected, including Windows 10 21H2/22H2/1809/1607, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations. No public exploit code has been identified and there is no CISA KEV listing, so this is a credible patch-priority item rather than an emergency, but the broad install base and the fact that media files are routinely auto-previewed in Explorer, Outlook and Teams should drive prompt patching.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code in the context of the user who opens or previews a specially crafted email or attachment, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2024 before 16.0.17932.21056, and Office LTSC 2021 before 16.0.14334.20974. Exploitation is gated by mandatory victim interaction (UI:R) and code runs at the interacting user's privilege level rather than SYSTEM (S:U), so it is a high-priority but not emergency-level issue. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as none with total technical impact; vendor-released patches are available. Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (CVSS 8.8); CWE-122; EUVD-2026-99710.
Heap-based buffer overflow in Microsoft Outlook allows remote code execution in the context of the logged-on user when a victim opens or renders a specially crafted email item. Affected builds are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2024 prior to 16.0.17932.21056; the flaw is network-reachable and requires no authentication on the target (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, rated 8.8, CWE-122). CISA's SSVC assessment records no observed exploitation and non-automatable delivery, and no public exploit code has been identified at time of analysis, so this is a credible high-priority patching item rather than a confirmed emergency - mitigated in practice by mandatory user interaction and user-level (non-admin) execution context.
Local privilege escalation in the Microsoft Desktop Window Manager (dwm.exe) allows an authenticated attacker who already holds a low-privileged session to trigger a heap-based buffer overflow and execute code at a higher integrity level, up to SYSTEM, on unpatched Windows 10, Windows 11 and Windows Server 2019-2025 hosts. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) the flaw is reachable only through local code execution, requires no user interaction, and functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', though technical impact is rated total, so the vulnerability is a credible but not emergency-tier patch priority.
Heap-based buffer overflow in Microsoft Outlook lets an unauthenticated remote attacker execute arbitrary code by getting a crafted message processed by a vulnerable client, with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 as the root-cause class. Affected builds are Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft Office LTSC 2021 before 16.0.14334.20974, and unpatched Microsoft 365 Apps for Enterprise channels; because the assessed vector carries PR:N/UI:N, delivery of a malicious message to the mailbox is sufficient under default configurations, with patch state as the main limiting factor. Vendor-released patch: available from Microsoft per the MSRC update guide; there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' while flagging the flaw as automatable with total technical impact.
Local privilege escalation in the Windows Storage Spaces Controller lets an authenticated low-privileged user corrupt kernel heap memory and gain execution at SYSTEM level, because the component fails to bounds-check attacker-influenced data (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The affected surface is the Storage Spaces Controller present by default across Windows 10, Windows 11 and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations; patched builds (for example Windows 11 24H2 10.0.26100.9711, Windows Server 2025 10.0.26100.33650) are not exploitable. Exploitation is confined to a post-compromise scenario requiring an existing local foothold or valid low-privileged credentials, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable exploitation as 'no', and the independent assessment rates this as credible but not emergency-priority.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an authenticated attacker who already holds low-privileged code execution on a Windows host trigger a heap-based buffer overflow in kernel mode and elevate to SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is required and attack complexity is low once a foothold exists, but it is not remotely reachable and cannot be triggered by luring a victim to open content. A vendor patch is available from Microsoft (per the MSRC update guide) and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a high-priority patch target for organizations that cannot fully prevent local code execution on endpoints and servers.
Code execution in Microsoft Word is possible when a user opens a specially crafted document that triggers a heap-based buffer overflow (CWE-122) in the application's document parsing logic. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is unauthenticated and needs no elevated privileges, but it is local in nature and requires the victim to open a malicious file, meaning an attacker must first succeed at social engineering - the SSVC assessment records Exploitation=none, Automatable=no, and there is no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) activity. Successful exploitation yields arbitrary code only in the security context of the user who opened the document, not inherently SYSTEM or administrator, so the practical risk is a workstation-level compromise rather than immediate full host takeover.
Privilege escalation in Windows OLE DB allows an unauthenticated remote attacker to elevate to SYSTEM by inducing a victim to open a crafted file or connect to an attacker-controlled data source that a vulnerable OLE DB provider parses, causing a heap-based buffer overflow (CWE-122). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms authentication is not required, but user interaction is mandatory - there is no zero-click network path, which is the main limiting factor. All default Windows installations are affected across Windows 10, Windows 11 (22H2 through 26H2) and Windows Server 2012 through 2025 including Server Core; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a high-priority patch item rather than an emergency.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Unauthenticated remote code execution is possible against the Windows System Information Console, where a heap-based buffer overflow (CWE-122) reachable over the network lets an attacker with no credentials and no user interaction run arbitrary code in the context of the affected component. Every supported Windows client and server build remains vulnerable until the vendor's security updates are applied - for example Windows 11 24H2 build 10.0.26100.9711, Windows Server 2025 build 10.0.26100.33650, and Windows Server 2016 build 10.0.14393.9612. Exploitation has not been observed (CISA SSVC exploitation: none) and no public exploit code is identified at time of analysis, but with CVSS 9.8, an automatable attack path, and total technical impact, the divergence between the severity signal and the quiet exploitation picture is the central risk consideration - the practical constraint is simply whether the affected component is network-reachable on a given host.
Remote code execution in the Microsoft PostScript Printer Driver on unpatched Windows client and server builds allows an unauthenticated attacker to corrupt heap memory (CWE-122) by delivering crafted PostScript content over the network to a reachable print path, yielding high confidentiality, integrity, and availability impact per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. The full set of supported Windows 10, Windows 11, and Windows Server branches (2012 through 2025, including Server Core installations) is affected at the build levels listed in the vendor advisory, so virtually every maintained Windows print host is in scope until updated. Despite the 9.8 base score, CISA's SSVC assessment records Exploitation as 'none' and no public exploit code has been identified at time of analysis, so this should be treated as a critical, patch-immediately issue rather than an actively exploited one; Microsoft has released fixing updates through the Security Update Guide (MSRC, mirrored as ENISA EUVD-2026-100162).
A heap over-read in the Windows Client Side Caching driver (csc.sys) allows an attacker to disclose sensitive memory contents, affecting Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 builds prior to the vendor's fixed revisions. Microsoft's advisory carries a CVSS 8.8 score with a network, user-interaction vector (AV:N/PR:N/UI:R), whereas the independent assessment bounds the flaw to an authorized attacker who already holds local access on the host (AV:L/PR:L/UI:N) - a material conflict that should be resolved against the vendor advisory before prioritization. Vendor patches are available and no public exploit code has been identified at time of analysis; CISA's SSVC record lists exploitation as 'none' and automatable as 'no', and no EPSS score was supplied.
Remote code execution is possible in the Microsoft PostScript Printer Driver, where a heap-based buffer overflow (CWE-122) lets an unauthenticated attacker who can deliver crafted PostScript print data over the network corrupt heap memory and execute arbitrary code in the context of the Windows Print Spooler. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required; every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected unless it has been updated to the fixed build listed by Microsoft. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis - SSVC records exploitation as 'none' - so the practical exposure is driven by whether the print/spooler service is reachable from untrusted networks.
A heap-based buffer overflow in the Windows Network File System (NFS) Server role lets an attacker who already holds local, low-privileged authenticated access on a Windows host execute code in a higher-privileged context, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Exploitation is constrained by prerequisites: the optional NFS Server / Services for NFS feature must actually be installed and enabled - it is absent from default Windows installations - and the attacker must already be on the box with valid low-privilege credentials; no user interaction is required. Vendor-released patches exist for all listed Windows client and server builds, no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), so this is a moderate-to-serious patching priority rather than a top-tier emergency. Defenders should note the scoring discrepancy flagged in the independent assessment: NFS is a network-facing service, yet Microsoft scored the vector as LOCAL - confirm via the MSRC advisory whether any network-adjacent trigger path exists beyond the local vector.
Local privilege escalation in the Windows Update Service lets an authenticated attacker with low-level local access (CVSS PR:L/AV:L) corrupt heap memory to gain SYSTEM-level code execution on unpatched Windows client and server builds. The flaw is a heap-based buffer overflow (CWE-122) that requires no user interaction and no special configuration, since the Windows Update Service is enabled by default; exploitation cannot be automated or performed remotely, and no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Microsoft Windows OLE allows an attacker who already holds low-privileged authenticated access on a host to drive a heap-based buffer overflow by inducing the vulnerable component to process a crafted OLE object, resulting in code execution at a higher integrity level with complete loss of confidentiality, integrity, and availability (CVSS 7.8, CWE-122). The issue spans a wide set of unpatched Windows client and server builds, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; vendor fixes are available and no public exploit code was identified at time of analysis. Because the attack is local (AV:L), requires existing credentials (PR:L), needs no victim interaction (UI:N), and is classified as non-automatable with exploitation 'none' under CISA's SSVC framework, it is a second-tier, post-compromise escalation primitive rather than a remote or wormable threat.
Local privilege escalation in the Windows Portable Device File System Driver lets an authenticated, low-privileged attacker who already has code execution on a Windows host trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM. The flaw spans an unusually wide set of builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - and carries a vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft has released fixes, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis; the operative constraint is the required local foothold, which makes this a second-stage escalation primitive rather than an entry point.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows a local attacker to elevate privileges on affected Windows hosts by supplying a crafted media file that the logged-in user opens, previews, or otherwise has parsed by the platform's media pipeline. Successful exploitation is assessed at CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-122), yielding high confidentiality, integrity, and availability impact; because the vector is local with a user-interaction prerequisite, the attacker must first land the file on the target and induce the user to process it, which makes this a credible but interaction-gated escalation path rather than a network-facing exploit. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); a vendor patch is available, and fully updated builds (those at or above the version thresholds enumerated in the EUVD affected-version data) are not affected. Despite being an LPE rather than an RCE, the no-privilege prerequisite, low complexity, and full three-property impact keep this a legitimate prioritization candidate in environments where media files are routinely handled.
Local privilege escalation in the Microsoft Graphics Component affects multiple Windows client and server builds, allowing a local, authenticated attacker with low privileges (CVSS AV:L/PR:L) to exploit a numeric truncation error and gain High confidentiality, integrity, and availability impact after corrupting heap memory. The vulnerability has a CVSS 3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires no user interaction, and is not a remote entry point; no public exploit was identified at time of analysis, and no EPSS score was provided. A vendor patch is available per Microsoft, so affected organizations should prioritize update deployment on all listed Windows versions and Server Core installations.
Local privilege escalation in the Windows Kernel allows an authenticated low-privilege attacker with existing code execution on a target host to trigger a heap-based buffer overflow and elevate privileges in kernel mode. Affected default installations include Windows 10, Windows 11 21H2 through 26H1, and Windows Server 2019/2022/2025 builds below the vendor-patched build levels. No public exploit identified at time of analysis and CISA SSVC reports no exploitation; a vendor patch is available.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authenticated local attacker holding only standard user rights to corrupt kernel heap memory and elevate to full SYSTEM-level privileges on unpatched Windows hosts. The vulnerability is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and affects a very broad install base, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016 through 2025, so it functions as a reliable post-compromise escalation primitive rather than an initial-access emergency. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none, and the CVE is not listed in KEV; Microsoft has released vendor patches with fixed servicing builds for every affected branch.
Local privilege escalation in the Windows Kernel allows a low-privileged, authenticated attacker who already holds code execution on a target host to trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM-level privileges. The vulnerability is strictly local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it provides no remote or network path and is only useful as a post-compromise escalation step rather than an initial access vector. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with 'Automatable: no', because the attacker must already have a local foothold; Microsoft has published patched builds for the affected Windows 11 and Windows Server releases.
Heap-based buffer overflow in the Microsoft Windows Storage Spaces driver (Spaceport.sys) allows an authenticated, low-privileged local user to execute code in kernel context and elevate privileges, carrying a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attacker must already hold a session on the target host, so this is best treated as a post-compromise privilege-escalation step rather than a remote entry point, and no user interaction is required beyond the existing local session. Vendor-released patches exist for all affected Windows 10, Windows 11 and Windows Server builds; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none". Compared with network-facing, pre-authentication bugs this rates as a credible but not emergency-tier priority: patch it on a normal cycle, but prioritize systems where untrusted or low-privileged users can obtain local interactive sessions.
A heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver lets a local attacker who persuades a victim to process a crafted PostScript print job or document elevate privileges on affected Windows client and server releases. The flaw requires local access (AV:L) and user interaction (UI:R) but no prior privileges (PR:N), so it is a targeted rather than opportunistic local privilege-escalation vector; CISA SSVC rates it non-automatable with no observed exploitation, and no public exploit code has been identified at time of analysis. Vendor patches are available and, per the assessed impact (C:H/I:H/A:H), successful exploitation gives full code execution in the driver's higher-privileged context.
Heap-based buffer overflow in the Windows Win32 kernel subsystem lets a locally authenticated low-privilege attacker escalate to full system privileges on an affected host. Every supported Windows build in the EUVD-listed ranges is exposed by default - Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2 (including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both full and Server Core installations - until the corresponding cumulative update is applied; CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so impact on confidentiality, integrity and availability is total once the primitive is triggered. Microsoft has published fixes in its update guide, and no public exploit code or active exploitation has been identified at time of analysis (CISA SSVC exploitation: none). The practical barrier is that the attacker must already hold local code execution on the target, making this a post-compromise privilege-escalation step rather than an initial-access vector.
Heap-based buffer overflow in the Windows kernel (CVE-2026-70106) allows an attacker who already holds low-privileged local code execution to elevate privileges on the affected host, scoring 7.8 under CVSS v3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exposure is broad across build numbers - Windows 10, Windows 11 and Windows Server 2012 through 2025, including Server Core - but the attack is gated behind an existing local foothold, so it is a post-compromise escalation primitive rather than a remotely reachable one. Microsoft has released fixes through the MSRC update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC exploitation: none).
Heap-based buffer overflow in Microsoft Windows Error Reporting (WER) lets a locally authenticated attacker holding only low-level privileges elevate their privileges on the host, with full confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No user interaction or non-default configuration is required because WER is a built-in subsystem present across every affected Windows 10, Windows 11 and Windows Server 2016-2025 SKU, but the flaw is not remotely exploitable: the attacker must already be able to run code locally under a valid low-privilege account. There is no confirmed active exploitation (the CVE is not in CISA KEV) and no public exploit code identified at time of analysis; Microsoft has published a fix and an advisory entry for the issue, so affected builds below the fixed thresholds should be updated.
Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Rich Text Edit Control (the riched20/msftedit engine used by WordPad, Outlook, and many applications that render Rich Text Format content) lets an attacker who already holds authenticated low-privileged access on a Windows host trigger a heap-based buffer overflow and obtain higher-integrity code execution. Exploitation requires the attacker to invoke the control with attacker-controlled rich-text content (CVSS PR:L, UI:N), so it is a post-compromise escalation primitive rather than a remote or unauthenticated path; SSVC rates the technical impact as total but flags the issue as not automatable, meaning reliable mass exploitation is unlikely, and no public exploit was identified at time of analysis. Microsoft has published a vendor fix, so the residual risk is concentrated on unpatched Windows 10, Windows 11, and Windows Server builds where a low-privileged foothold already exists.