Information Disclosure
Monthly
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. No public exploit code and no active exploitation have been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds memory read in Microsoft Office Word discloses potentially sensitive process memory contents when a victim opens a specially crafted document, affecting Microsoft 365 Apps for Enterprise, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and macOS editions across both Windows and macOS platforms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-delivered, low-complexity information-disclosure flaw requiring user interaction but no attacker-side privileges. Vendor patch is confirmed available via Microsoft MSRC; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (CWE-125) allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts - covering virtually the entire active Office install base. No public exploit code or active exploitation has been identified; SSVC rates the exploitation likelihood as none and technical impact as partial, consistent with the 6.5 CVSS base score.
Out-of-bounds read in Microsoft Word across Office 2016 through Microsoft 365 Apps enables an unauthenticated remote attacker to disclose sensitive memory contents when a user opens a crafted document. The vulnerability (CWE-125) affects both Windows (x86/x64) and macOS deployments of the Office suite across multiple release tracks - retail, LTSC, and subscription. No public exploit or active exploitation has been identified at time of analysis, though the broad install base and socially-engineered document delivery make this a realistic phishing vector.
Out-of-bounds memory read in Microsoft PowerPoint's file-parsing logic exposes sensitive process memory when a victim opens a specially crafted presentation file, allowing a remote unauthenticated attacker to disclose heap or stack contents. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS platforms. Microsoft has released patched builds via the MSRC advisory; no public exploit identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Office Outlook allows a remote unauthenticated attacker to leak process memory contents when a victim opens or previews a crafted email message or attachment. All major Office branches are affected - Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - spanning hundreds of millions of endpoints globally. Microsoft has released patches across all affected branches; no public exploit code exists and CISA SSVC rates exploitation as 'none' at the time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a remote, unauthenticated attacker who can convince a user to open a crafted document. The flaw (CWE-125) affects the full current Office portfolio - Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts - with high confidentiality impact and no integrity or availability consequence. No public exploit identified at time of analysis; vendor-released patches are available for all Windows versions with specific build thresholds.
Out-of-bounds read in Microsoft Office Word's document parser allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a crafted Word file. Affecting Word 2016, Office 2019/2021/2024 LTSC, and Microsoft 365 Apps for Enterprise across both x86 and x64 builds, the vulnerability carries a CVSS 6.5 with C:H but no integrity or availability impact. No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation as none and the attack as not automatable, moderating operational urgency despite the broad product footprint.
Out-of-bounds read in multiple Microsoft Office SKUs allows a remote unauthenticated attacker to disclose in-process memory contents by inducing a user to open a specially crafted document. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC on Windows, and multiple Mac variants. Exploitation yields high confidentiality impact with no integrity or availability consequence; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes arbitrary memory contents to a remote unauthenticated attacker who can convince a user to open a malicious file, resulting in high-confidence information disclosure. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS equivalents. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the phishing-file delivery model is a well-established Office exploitation pattern.
Out-of-bounds read in Microsoft Office Outlook allows a remote, unauthenticated attacker to disclose sensitive information from process memory by inducing a user to open or interact with a maliciously crafted email or document. Affected products span Outlook 2016 through Microsoft 365 Apps for Enterprise, covering a large portion of the enterprise desktop install base. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected product lines via MSRC.
Out-of-bounds read in Microsoft Office Word allows an unauthenticated remote attacker to disclose memory contents when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024 on both x86 and x64 platforms. The flaw (CWE-125) resides in Word's document parser and can expose heap or stack memory to the attacker-controlled document, but is limited strictly to confidentiality impact - no code execution or integrity violation is possible from this flaw alone. Vendor-released patches are available across all affected product lines; no active exploitation has been identified and no public exploit code is known at time of analysis.
Out-of-bounds read in Microsoft Office Outlook and closely related Office suite components exposes sensitive in-memory data to network-based attackers who can deliver a crafted document to a user. The CVSS vector (C:H/I:N/A:N) and CWE-125 (Out-of-bounds Read) align on an information-disclosure primary impact, while Microsoft's description references code execution - a material discrepancy that warrants verification against the full MSRC advisory. Patches are available from Microsoft across all affected product lines including Office 2016 through 2024 LTSC and Microsoft 365 Apps on both Windows and macOS; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in Microsoft Excel enables an unauthenticated remote attacker to disclose sensitive memory contents when a victim opens a crafted Excel file. The vulnerability spans a broad range of Office product lines - including Office 2016, 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps for Enterprise, and Mac variants - making the exposure surface wide. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via Microsoft's update guide.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Out-of-bounds read in Microsoft Office Word enables remote attackers to disclose high-value in-process memory contents by convincing a user to open a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Word 2016, Office 2019/2021/2024 LTSC on Windows (x86/x64) and Office for Mac editions, this CWE-125 flaw requires no attacker authentication but does require victim interaction. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery, consistent with the phishing/social-engineering delivery model implied by the UI:R CVSS metric.
Out-of-bounds read (CWE-125) in Microsoft Word's document-parsing engine enables remote information disclosure across Microsoft 365 Apps, Office 2019, 2021, and 2024 LTSC on both Windows and macOS. An unauthenticated remote attacker (per CVSS PR:N) can cause Word to read beyond an allocated buffer when a victim opens a crafted document, potentially leaking sensitive memory contents to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates the attack as non-automatable with partial technical impact, placing this squarely in routine patch-cycle response rather than emergency remediation.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Out-of-bounds memory read in the Windows OLE DB component affects Microsoft SQL Server 2017 and 2019, enabling a network-based attacker to disclose sensitive memory contents. Exploitation requires user interaction - specifically, a victim client or application must connect to an attacker-controlled OLE DB data source that delivers a crafted response triggering CWE-125. No public exploit exists and CISA SSVC rates exploitation as none, though the CVSS C:H rating reflects the potential for significant memory disclosure against unpatched SQL Server deployments.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Integer underflow (CWE-191) in Microsoft SQL Server enables a locally authenticated, low-privileged attacker to disclose sensitive information from the database engine without requiring user interaction. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both GDR and cumulative update servicing tracks, with Microsoft releasing fixes across all affected branches. No public exploit code or active exploitation has been identified; SSVC scoring places this at Exploitation: none and Automatable: no, reflecting the constrained, local attack surface.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Word across Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise on both Windows and macOS allows a locally authenticated, low-privileged user to disclose adjacent process memory by opening a specially crafted document. The flaw carries a High confidentiality impact with no integrity or availability effects, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation status as none and automation as infeasible.
Out-of-bounds read (CWE-125) in Microsoft PowerPoint exposes memory contents to remote unauthenticated attackers who can convince a user to open a specially crafted presentation file. All major Office release channels are affected, including Microsoft 365 Apps for Enterprise, Office 2019, PowerPoint 2016, Office LTSC 2021, and Office LTSC 2024, on both Windows and Mac platforms. No public exploit or active exploitation has been confirmed; SSVC assessment rates exploitation as none and technical impact as partial, consistent with a CVSS 6.5 medium-severity information disclosure finding.
Untrusted pointer dereference in Microsoft Office PowerPoint exposes high-confidentiality memory contents to a remote, unauthenticated attacker who can convince a user to open a specially crafted presentation file. The flaw (CWE-822) allows the application to dereference a pointer sourced from untrusted file data without validation, enabling out-of-bounds or arbitrary memory reads that leak sensitive process memory over a network context. No public exploit code or CISA KEV listing is present at time of analysis, but the high-confidentiality CVSS rating and broad install base across all current Office versions make patch deployment a priority.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Type confusion (CWE-822) in Microsoft Office PowerPoint allows a remote unauthenticated attacker to disclose sensitive information from a victim's system by inducing them to open a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and Mac variants of Office across multiple release channels. Vendor-released patches are available for Windows editions with specific fixed build numbers; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Buffer over-read (CWE-126) in Microsoft Office exposes process memory contents to remote unauthenticated attackers when a victim opens a maliciously crafted Office document. The vulnerability spans a wide range of Office product lines across both Windows and macOS - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and the macOS Office 365/LTSC equivalents. No public exploit code has been identified and the CVE does not appear in the CISA KEV catalog at time of analysis; a vendor patch has been released across all affected product lines.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Information disclosure in Microsoft SharePoint Server Subscription Edition allows a low-privileged authenticated attacker to read sensitive data over the network by leveraging a SharePoint component that executes with unnecessary elevated privileges (CWE-250). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) reflects a straightforward network-accessible exploit requiring only basic user credentials, with no user interaction and high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. No public exploit code and no active exploitation have been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds memory read in Microsoft Office Word discloses potentially sensitive process memory contents when a victim opens a specially crafted document, affecting Microsoft 365 Apps for Enterprise, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and macOS editions across both Windows and macOS platforms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-delivered, low-complexity information-disclosure flaw requiring user interaction but no attacker-side privileges. Vendor patch is confirmed available via Microsoft MSRC; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (CWE-125) allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts - covering virtually the entire active Office install base. No public exploit code or active exploitation has been identified; SSVC rates the exploitation likelihood as none and technical impact as partial, consistent with the 6.5 CVSS base score.
Out-of-bounds read in Microsoft Word across Office 2016 through Microsoft 365 Apps enables an unauthenticated remote attacker to disclose sensitive memory contents when a user opens a crafted document. The vulnerability (CWE-125) affects both Windows (x86/x64) and macOS deployments of the Office suite across multiple release tracks - retail, LTSC, and subscription. No public exploit or active exploitation has been identified at time of analysis, though the broad install base and socially-engineered document delivery make this a realistic phishing vector.
Out-of-bounds memory read in Microsoft PowerPoint's file-parsing logic exposes sensitive process memory when a victim opens a specially crafted presentation file, allowing a remote unauthenticated attacker to disclose heap or stack contents. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS platforms. Microsoft has released patched builds via the MSRC advisory; no public exploit identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Office Outlook allows a remote unauthenticated attacker to leak process memory contents when a victim opens or previews a crafted email message or attachment. All major Office branches are affected - Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - spanning hundreds of millions of endpoints globally. Microsoft has released patches across all affected branches; no public exploit code exists and CISA SSVC rates exploitation as 'none' at the time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a remote, unauthenticated attacker who can convince a user to open a crafted document. The flaw (CWE-125) affects the full current Office portfolio - Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts - with high confidentiality impact and no integrity or availability consequence. No public exploit identified at time of analysis; vendor-released patches are available for all Windows versions with specific build thresholds.
Out-of-bounds read in Microsoft Office Word's document parser allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a crafted Word file. Affecting Word 2016, Office 2019/2021/2024 LTSC, and Microsoft 365 Apps for Enterprise across both x86 and x64 builds, the vulnerability carries a CVSS 6.5 with C:H but no integrity or availability impact. No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation as none and the attack as not automatable, moderating operational urgency despite the broad product footprint.
Out-of-bounds read in multiple Microsoft Office SKUs allows a remote unauthenticated attacker to disclose in-process memory contents by inducing a user to open a specially crafted document. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC on Windows, and multiple Mac variants. Exploitation yields high confidentiality impact with no integrity or availability consequence; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes arbitrary memory contents to a remote unauthenticated attacker who can convince a user to open a malicious file, resulting in high-confidence information disclosure. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS equivalents. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the phishing-file delivery model is a well-established Office exploitation pattern.
Out-of-bounds read in Microsoft Office Outlook allows a remote, unauthenticated attacker to disclose sensitive information from process memory by inducing a user to open or interact with a maliciously crafted email or document. Affected products span Outlook 2016 through Microsoft 365 Apps for Enterprise, covering a large portion of the enterprise desktop install base. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected product lines via MSRC.
Out-of-bounds read in Microsoft Office Word allows an unauthenticated remote attacker to disclose memory contents when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024 on both x86 and x64 platforms. The flaw (CWE-125) resides in Word's document parser and can expose heap or stack memory to the attacker-controlled document, but is limited strictly to confidentiality impact - no code execution or integrity violation is possible from this flaw alone. Vendor-released patches are available across all affected product lines; no active exploitation has been identified and no public exploit code is known at time of analysis.
Out-of-bounds read in Microsoft Office Outlook and closely related Office suite components exposes sensitive in-memory data to network-based attackers who can deliver a crafted document to a user. The CVSS vector (C:H/I:N/A:N) and CWE-125 (Out-of-bounds Read) align on an information-disclosure primary impact, while Microsoft's description references code execution - a material discrepancy that warrants verification against the full MSRC advisory. Patches are available from Microsoft across all affected product lines including Office 2016 through 2024 LTSC and Microsoft 365 Apps on both Windows and macOS; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in Microsoft Excel enables an unauthenticated remote attacker to disclose sensitive memory contents when a victim opens a crafted Excel file. The vulnerability spans a broad range of Office product lines - including Office 2016, 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps for Enterprise, and Mac variants - making the exposure surface wide. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via Microsoft's update guide.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Out-of-bounds read in Microsoft Office Word enables remote attackers to disclose high-value in-process memory contents by convincing a user to open a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Word 2016, Office 2019/2021/2024 LTSC on Windows (x86/x64) and Office for Mac editions, this CWE-125 flaw requires no attacker authentication but does require victim interaction. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery, consistent with the phishing/social-engineering delivery model implied by the UI:R CVSS metric.
Out-of-bounds read (CWE-125) in Microsoft Word's document-parsing engine enables remote information disclosure across Microsoft 365 Apps, Office 2019, 2021, and 2024 LTSC on both Windows and macOS. An unauthenticated remote attacker (per CVSS PR:N) can cause Word to read beyond an allocated buffer when a victim opens a crafted document, potentially leaking sensitive memory contents to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates the attack as non-automatable with partial technical impact, placing this squarely in routine patch-cycle response rather than emergency remediation.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Out-of-bounds memory read in the Windows OLE DB component affects Microsoft SQL Server 2017 and 2019, enabling a network-based attacker to disclose sensitive memory contents. Exploitation requires user interaction - specifically, a victim client or application must connect to an attacker-controlled OLE DB data source that delivers a crafted response triggering CWE-125. No public exploit exists and CISA SSVC rates exploitation as none, though the CVSS C:H rating reflects the potential for significant memory disclosure against unpatched SQL Server deployments.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Integer underflow (CWE-191) in Microsoft SQL Server enables a locally authenticated, low-privileged attacker to disclose sensitive information from the database engine without requiring user interaction. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both GDR and cumulative update servicing tracks, with Microsoft releasing fixes across all affected branches. No public exploit code or active exploitation has been identified; SSVC scoring places this at Exploitation: none and Automatable: no, reflecting the constrained, local attack surface.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Word across Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise on both Windows and macOS allows a locally authenticated, low-privileged user to disclose adjacent process memory by opening a specially crafted document. The flaw carries a High confidentiality impact with no integrity or availability effects, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation status as none and automation as infeasible.
Out-of-bounds read (CWE-125) in Microsoft PowerPoint exposes memory contents to remote unauthenticated attackers who can convince a user to open a specially crafted presentation file. All major Office release channels are affected, including Microsoft 365 Apps for Enterprise, Office 2019, PowerPoint 2016, Office LTSC 2021, and Office LTSC 2024, on both Windows and Mac platforms. No public exploit or active exploitation has been confirmed; SSVC assessment rates exploitation as none and technical impact as partial, consistent with a CVSS 6.5 medium-severity information disclosure finding.
Untrusted pointer dereference in Microsoft Office PowerPoint exposes high-confidentiality memory contents to a remote, unauthenticated attacker who can convince a user to open a specially crafted presentation file. The flaw (CWE-822) allows the application to dereference a pointer sourced from untrusted file data without validation, enabling out-of-bounds or arbitrary memory reads that leak sensitive process memory over a network context. No public exploit code or CISA KEV listing is present at time of analysis, but the high-confidentiality CVSS rating and broad install base across all current Office versions make patch deployment a priority.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Type confusion (CWE-822) in Microsoft Office PowerPoint allows a remote unauthenticated attacker to disclose sensitive information from a victim's system by inducing them to open a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and Mac variants of Office across multiple release channels. Vendor-released patches are available for Windows editions with specific fixed build numbers; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Buffer over-read (CWE-126) in Microsoft Office exposes process memory contents to remote unauthenticated attackers when a victim opens a maliciously crafted Office document. The vulnerability spans a wide range of Office product lines across both Windows and macOS - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and the macOS Office 365/LTSC equivalents. No public exploit code has been identified and the CVE does not appear in the CISA KEV catalog at time of analysis; a vendor patch has been released across all affected product lines.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Information disclosure in Microsoft SharePoint Server Subscription Edition allows a low-privileged authenticated attacker to read sensitive data over the network by leveraging a SharePoint component that executes with unnecessary elevated privileges (CWE-250). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) reflects a straightforward network-accessible exploit requiring only basic user credentials, with no user interaction and high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.