Microsoft
Monthly
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Remote code execution in Microsoft Word (part of Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024) allows unauthenticated attackers to execute arbitrary code in the context of the victim who opens a crafted document. The vulnerability is an off-by-one error (CWE-193) in the Word parser that can corrupt memory, and no public exploit code or active exploitation has been identified at time of analysis. Microsoft has released a patch via its MSRC update guide.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Security-feature bypass in Microsoft Office Word - including the wider Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 families on Windows and macOS - lets an attacker defeat a protection mechanism such as Protected View, mark-of-the-web enforcement, or a trust/macro prompt by getting a victim to open or preview a crafted document. No attacker credentials or prior access are required (CVSS PR:N), but exploitation is local (AV:L) and depends on the target user interacting with the file (UI:R); a successful bypass yields high confidentiality, integrity, and availability impact for a 7.8 High severity rating. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched update through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433).
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Elevation of privilege in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user perform actions reserved for higher-privileged accounts over the network, yielding high confidentiality, integrity, and availability impact across the affected server. The flaw is a missing authorization check (CWE-862) rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not usable by fully unauthenticated outsiders: the attacker must already hold a valid low-privilege SharePoint account and the site must be network-reachable, with no user interaction or non-default configuration required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation requires a motivated authenticated insider or an attacker who has already obtained low-privilege credentials; Microsoft has published a vendor patch, making this a straightforward fix-and-prioritize item for exposed SharePoint deployments.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Code injection in TeamPlus Messenger allows unauthenticated remote attackers to trick a user into interacting with crafted content, injecting and executing arbitrary JavaScript; after the user confirms a Windows security warning, arbitrary code executes with the victim's privileges. The CVSS 4.0 vector scores 8.6 (High) with UI:A, gated by two distinct user actions: interacting with the malicious content and then accepting an OS-level security prompt. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Privilege elevation in Microsoft SQL Server lets an attacker who already holds high-privilege credentials on the instance trigger a stack-based buffer overflow over a network connection and break out of their authorization boundary. Exploitation is constrained: the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C) and the vendor description both indicate an authorized, highly privileged principal is required, and the AC:H rating means the overflow depends on specific server state, data, or timing rather than trivial input, so it is not reliably repeatable on a first attempt. All affected GDR and CU builds are pre-patch, Microsoft has published a fix via the MSRC update guide, and no public exploit or confirmed active exploitation was identified at time of analysis, so risk is real but conditional rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.
Remote code execution in Microsoft SQL Server 2022 and 2025 arises from a stack-based buffer overflow (CWE-121) that is triggered when a client connects to an attacker-controlled SQL Server endpoint and the malicious response overflows a fixed-size stack buffer. The vulnerability is unauthenticated from the attacker's side (PR:N) but requires victim-side interaction (UI:R) and high attack complexity (AC:H), so it is a moderate-priority issue rather than a mass-exploitation emergency; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Affected builds are SQL Server 2022 GDR below 16.0.1210.3 and CU27 below 16.0.4305.5, plus SQL Server 2025 GDR below 17.0.1145.4 and CU9 below 17.0.5015.4, with vendor-released patches available from Microsoft.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.
Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.
Deserialization of untrusted data in Microsoft SQL Server (SQL Server 2019, 2022, and 2025 GDR/CU builds) allows an attacker to achieve remote code execution with high confidentiality, integrity, and availability impact. Exploitation requires the attacker to already hold valid low-privilege authenticated access to the target instance (CVSS PR:L) plus network reachability (AV:N), with no user interaction (UI:N), so credential-less external attackers cannot exploit it directly; realistic risk concentrates on instances reachable by untrusted or lower-trust database users, such as multi-tenant applications, service accounts, or internal users. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis, but the technical impact is rated total. Microsoft has released fixed builds for every affected branch.
Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Improper type validation in Microsoft .NET Framework allows unauthenticated remote attackers to tamper with data in .NET-based applications that parse attacker-supplied input over the network, affecting multiple framework branches including 3.5, 4.6.2 through 4.8.1. Microsoft has released patched builds for each affected branch (for example, 4.8.4811.0 for .NET Framework 4.8 and 4.8.9363.0 for 4.8.1), so exploitation is only possible against unpatched systems; no public exploit code or active exploitation is identified at time of analysis. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable flaw whose impact is confined to integrity tampering, with no confidentiality or availability effect.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.
Unbounded resource allocation in ASP.NET Core - reachable through the System.Formats.Cbor component shipped with Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 - lets unauthenticated remote attackers exhaust server resources and cause a denial of service. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact), meaning any network-exposed service that actually parses attacker-supplied CBOR input through the vulnerable path can be driven into resource exhaustion without credentials or user interaction. Exploitation is bounded by reachability: deployments that never process untrusted external CBOR/network data, or that sit behind request-size limits, rate limiting, timeouts, or a WAF, have materially reduced exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available via the Microsoft Security Response Center advisory.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition due to a path traversal flaw (CWE-22) that permits an attacker with low-privilege credentials to escape restricted directories and execute code over the network. The vulnerability carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N) and requires a valid SharePoint session, making it a credible priority for patching but not an immediate emergency according to current evidence. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
Remote code execution in Microsoft Outlook is possible through a heap-based buffer overflow that an unauthenticated, network-based attacker can trigger by convincing a victim to open or preview a crafted email message or Office document. The vulnerability affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365 for Mac, but a vendor patch is available. Exploitation carries a high attack complexity due to required heap grooming and memory-layout control, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac/LTSC for Mac editions, allowing an unauthenticated attacker to execute arbitrary code by convincing a victim to open a specially crafted document (UI:R). The stack-based buffer overflow (CWE-121) requires no privileges or non-default configuration (PR:N, AC:L), making it a high-priority target for social-engineering campaigns, though no public exploit code has been identified at time of analysis. Patch available per vendor advisory from the Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office (Windows and macOS builds: Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac) allows unauthenticated remote attackers to execute arbitrary code when a victim opens a crafted document. Exploitation requires user interaction (UI:R in the CVSS vector) and is not zero-click, executing with the victim user's privileges rather than SYSTEM. No public exploit has been identified at time of analysis, and a vendor patch is available per the Microsoft advisory (CVE-2026-108444).
Remote code execution in Microsoft Word (part of Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024) allows unauthenticated attackers to execute arbitrary code in the context of the victim who opens a crafted document. The vulnerability is an off-by-one error (CWE-193) in the Word parser that can corrupt memory, and no public exploit code or active exploitation has been identified at time of analysis. Microsoft has released a patch via its MSRC update guide.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
Stack-based buffer overflow in Microsoft Word permits remote code execution in affected Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC 2021/2024 (including Mac editions) when a victim opens a maliciously crafted document. The vulnerability is unauthenticated from the attacker's perspective but requires user interaction (UI:R), so delivery typically depends on phishing or social engineering, and no public exploit identified at time of analysis or CISA KEV confirmation is available in the provided data. Patch available per vendor advisory via Microsoft's MSRC update guide.
Heap-based memory corruption in Microsoft Word lets a remote, unauthenticated attacker execute arbitrary code in the security context of the user who opens a specially crafted Word document. Affected software includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 and 2024, and the corresponding Office LTSC/Office 365 for Mac builds referenced in the CPE list; exploitation is not automatic, since the victim must open the malicious file (UI:R), but no credentials or special configuration are required otherwise. Microsoft has published a security update, and no public exploit code was identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
Security-feature bypass in Microsoft Office Word - including the wider Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 families on Windows and macOS - lets an attacker defeat a protection mechanism such as Protected View, mark-of-the-web enforcement, or a trust/macro prompt by getting a victim to open or preview a crafted document. No attacker credentials or prior access are required (CVSS PR:N), but exploitation is local (AV:L) and depends on the target user interacting with the file (UI:R); a successful bypass yields high confidentiality, integrity, and availability impact for a 7.8 High severity rating. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched update through its Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433).
Heap-based buffer overflow in Microsoft Word allows remote, unauthenticated attackers to execute arbitrary code when a user opens a maliciously crafted document. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS editions, with a CVSS score of 8.8; no public exploit identified at time of analysis, and CISA KEV does not list active exploitation, though high impact and low attack complexity make this a genuine high-priority issue. The primary limiting factor is the required user interaction to open the weaponized file, and code runs with the victim's privileges rather than SYSTEM.
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac when a user opens or previews a specially crafted document. The flaw is a stack-based buffer overflow (CWE-121) rated 8.8, reachable by unauthenticated remote attackers with PR:N but requiring user interaction with UI:R; successful exploitation yields code execution with the victim user’s privileges. A vendor patch is available, and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
A heap-based buffer overflow in Microsoft Word's document-parsing code lets an unauthenticated remote attacker execute arbitrary code when a victim opens a maliciously crafted Word file, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. The attack is network-deliverable (typically a phishing attachment or downloaded document) but cannot trigger without user interaction, since the victim must open or preview the file; successful exploitation runs code in that user's security context rather than SYSTEM. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patching item - rated 8.8 with the vendor patch already available - rather than an emergency zero-day response.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Elevation of privilege in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user perform actions reserved for higher-privileged accounts over the network, yielding high confidentiality, integrity, and availability impact across the affected server. The flaw is a missing authorization check (CWE-862) rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is not usable by fully unauthenticated outsiders: the attacker must already hold a valid low-privilege SharePoint account and the site must be network-reachable, with no user interaction or non-default configuration required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation requires a motivated authenticated insider or an attacker who has already obtained low-privilege credentials; Microsoft has published a vendor patch, making this a straightforward fix-and-prioritize item for exposed SharePoint deployments.
Eclipse NetX Duo's NetX Secure DTLS server can be driven into completing handshakes with forged source addresses because the cookie it issues in a HelloVerifyRequest is never actually validated: the ClientHello parser copies the client-supplied cookie bytes over the value the server generated, and the server then treats the peer as verified based on the cookie's length alone, so a single arbitrary cookie byte in the first ClientHello skips the return-routability exchange entirely. The defect is remotely reachable with no authentication and no user interaction (CVSS 4.0 base 8.7, High; the independent assessment confirms AV:N/AC:L/PR:N/UI:N with an availability-only impact), and the practical harm is anti-spoofing and availability abuse - spoofed-source handshakes, amplification potential, and handshake state/resource exhaustion - not data compromise or code execution. No public exploit code has been identified at time of analysis, and CVE-2026-106465 is not listed in CISA KEV.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Code injection in TeamPlus Messenger allows unauthenticated remote attackers to trick a user into interacting with crafted content, injecting and executing arbitrary JavaScript; after the user confirms a Windows security warning, arbitrary code executes with the victim's privileges. The CVSS 4.0 vector scores 8.6 (High) with UI:A, gated by two distinct user actions: interacting with the malicious content and then accepting an OS-level security prompt. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Privilege elevation in Microsoft SQL Server lets an attacker who already holds high-privilege credentials on the instance trigger a stack-based buffer overflow over a network connection and break out of their authorization boundary. Exploitation is constrained: the CVSS vector (AV:N/AC:H/PR:H/UI:N/S:C) and the vendor description both indicate an authorized, highly privileged principal is required, and the AC:H rating means the overflow depends on specific server state, data, or timing rather than trivial input, so it is not reliably repeatable on a first attempt. All affected GDR and CU builds are pre-patch, Microsoft has published a fix via the MSRC update guide, and no public exploit or confirmed active exploitation was identified at time of analysis, so risk is real but conditional rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft SQL Server lets an authenticated attacker who holds any valid, low-privileged database login - and can reach the instance's listening port over the network - execute code in the context of the SQL Server service process, with high confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no user interaction). The vendor has released patched builds for SQL Server 2017, 2019, 2022 and 2025, and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible priority rather than an emergency. Because exploitation needs only ordinary credentials rather than sysadmin rights, the practical exposure is concentrated on instances reachable from untrusted networks and on estates where database logins are shared or weakly managed.
Remote code execution in Microsoft SQL Server 2022 and 2025 arises from a stack-based buffer overflow (CWE-121) that is triggered when a client connects to an attacker-controlled SQL Server endpoint and the malicious response overflows a fixed-size stack buffer. The vulnerability is unauthenticated from the attacker's side (PR:N) but requires victim-side interaction (UI:R) and high attack complexity (AC:H), so it is a moderate-priority issue rather than a mass-exploitation emergency; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation. Affected builds are SQL Server 2022 GDR below 16.0.1210.3 and CU27 below 16.0.4305.5, plus SQL Server 2025 GDR below 17.0.1145.4 and CU9 below 17.0.5015.4, with vendor-released patches available from Microsoft.
Local privilege elevation in Microsoft SQL Server 2019, 2022, and 2025 stems from a heap-based buffer overflow that a low-privileged authenticated user with local access can trigger to gain elevated rights on the database host. Exploitation is not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:N) demands an existing authorized database session plus successful heap manipulation, and no public exploit has been identified at time of analysis, with no CISA KEV listing. Vendor patches are available, so this is a moderate-priority hardening item rather than a drop-everything emergency.
Heap-based buffer overflow in Microsoft SQL Server lets an attacker who already holds a valid low-privilege database login execute arbitrary code on the database engine over the network, with impact crossing a security scope boundary (CVSS 8.5; AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected builds span SQL Server 2017, 2019, 2022, and 2025 across both the GDR (security-only) and cumulative-update branches, so most unpatched enterprise estates that still run older builds are in scope. Exploitation is not trivial - the high attack complexity implies reliable heap layout/grooming or a timing-sensitive corruption window must be achieved - and there is no public exploit identified at time of analysis, but a vendor patch is available and the flaw should be prioritized on internet-exposed or broadly accessible database listeners.
Privilege elevation in Microsoft SQL Server (2017, 2019, 2022 and 2025 builds below their patched levels) allows an authenticated, low-privileged database principal to trigger a heap-based buffer overflow in the database engine over a network connection and gain higher privileges, with impact crossing a security boundary (CVSS 8.5, S:C). Exploitation is not anonymous: the attacker must already hold a valid SQL Server login (PR:L) and satisfy a hard-to-control heap-state or race condition (AC:H), so the flaw is not automatable or scalable (SSVC Automatable: no, Exploitation: none), and no public exploit code has been identified at time of analysis. Microsoft has published fixed builds via its update guide, so this is a legitimate but not top-tier emergency priority - patch promptly, with urgency driven by the total technical impact and the broad installed base.
Deserialization of untrusted data in Microsoft SQL Server (SQL Server 2019, 2022, and 2025 GDR/CU builds) allows an attacker to achieve remote code execution with high confidentiality, integrity, and availability impact. Exploitation requires the attacker to already hold valid low-privilege authenticated access to the target instance (CVSS PR:L) plus network reachability (AV:N), with no user interaction (UI:N), so credential-less external attackers cannot exploit it directly; realistic risk concentrates on instances reachable by untrusted or lower-trust database users, such as multi-tenant applications, service accounts, or internal users. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis, but the technical impact is rated total. Microsoft has released fixed builds for every affected branch.
Heap-based buffer overflow in Microsoft Office Visio allows unauthenticated remote attackers to execute arbitrary code in the context of the user who opens a specially crafted Visio document, with the only barrier being user interaction (UI:R) - the victim must be socially engineered into opening the file. Affected builds are Microsoft 365 Apps for Enterprise (16.0.1, patched via the current channel at https://aka.ms/OfficeSecurityReleases), Office LTSC 2021 below 16.0.14334.20974, and Office LTSC 2024 below 16.0.17932.21056. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the 8.8 CVSS score, network attack vector, and complete confidentiality/integrity/availability impact make prompt patching a high priority for any environment where Visio is installed.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
A use-after-free in the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService) lets an attacker who already holds a low-privileged local session elevate privileges on the affected host, with high impact to confidentiality, integrity and availability. Microsoft scores it 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the affected service ships enabled by default across the listed Windows 10, Windows 11 and Windows Server 2019 build ranges, so exposure depends almost entirely on whether untrusted users can obtain interactive or code-execution access to the machine. No public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a credible but not emergency-tier patch priority rather than an actively exploited emergency; the limiting factor is the local attack vector, since there is no network-reachable exploitation path.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Improper type validation in Microsoft .NET Framework allows unauthenticated remote attackers to tamper with data in .NET-based applications that parse attacker-supplied input over the network, affecting multiple framework branches including 3.5, 4.6.2 through 4.8.1. Microsoft has released patched builds for each affected branch (for example, 4.8.4811.0 for .NET Framework 4.8 and 4.8.9363.0 for 4.8.1), so exploitation is only possible against unpatched systems; no public exploit code or active exploitation is identified at time of analysis. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable flaw whose impact is confined to integrity tampering, with no confidentiality or availability effect.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Local privilege escalation in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated attacker with existing low-privileged code execution to gain elevated privileges on affected Windows 11 and Windows Server systems. Exploitation requires local interaction with unionfs.sys and cannot be used for remote or initial compromise; the affected unpatched builds include Windows 11 23H2/24H2/25H2/26H2 and Windows Server 2022/2025. Vendor patches are available, no public exploit was identified at time of analysis, and this is a credible but second-tier priority for most environments.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Command injection in Microsoft OneNote allows an unauthenticated remote attacker to execute code when a victim opens a specially crafted OneNote document. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise 16.0.1 per EUVD, with user interaction being the primary exploitation barrier. No public exploit was identified at time of analysis, and Microsoft has published an advisory and update path via the MSRC update guide.
Heap-based buffer overflow in Microsoft Office Excel lets an unauthenticated remote attacker execute arbitrary code on a target system when the victim opens or previews a specially crafted spreadsheet, as described in Microsoft's MSRC update guide. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) confirms no privileges or credentials are needed, but the required user interaction makes phishing delivery of the malicious file the practical attack path, with any code running at the privilege level of the user who opens it. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024, Office for Mac (365/2021/2024), and Office Online Server, so this is a broad default-installation exposure; no public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has published an update so patching is the decisive control.
Remote code execution in Microsoft Excel occurs when a user opens an attacker-crafted spreadsheet, exploiting an integer overflow (wraparound) that corrupts memory while Excel processes the file. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the attacker needs no credentials and can deliver the file over the network, but successful exploitation hinges on the victim opening the document, so real-world attacks depend on social engineering or malicious file delivery rather than autonomous remote compromise. Affected builds include Office LTSC 2021 and 2024, Office Online Server, the Mac LTSC and 365 editions, and Microsoft 365 Apps for Enterprise; this is a genuine high-priority vulnerability, though there is no public exploit identified at time of analysis, and a vendor patch is available.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the security context of the current user when a victim opens an attacker-supplied workbook, rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No authentication or prior privileges are required, but exploitation is gated by user interaction - the attacker must deliver a malicious Excel file (typically by email, link, or download) and persuade the target to open or preview it, so the AV:N vector reflects file delivery over the network rather than a directly reachable network service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and Microsoft has shipped patched builds for the Windows Office and Office Online Server editions while macOS fixes remain pending publication.
Remote code execution in Microsoft Excel is possible via a heap-based buffer overflow that an unauthenticated attacker can trigger by convincing a targeted user to open a specially crafted workbook (UI:R), with code running in the context of that user. No public exploit code was identified at time of analysis, and the required user interaction - typically a phishing attachment, web-hosted document, or file-share lure - is the primary limiting factor on practical exploitation. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2024 and LTSC 2021, Office LTSC/365 for Mac, and Office Online Server, making this a genuine patch-priority item for environments still on vulnerable builds.
Opening or previewing an attacker-supplied Excel spreadsheet can allow a remote, unauthenticated attacker to run code in the security context of the user who opened the file on affected Windows and macOS Office builds (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and the corresponding Mac editions). The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so while delivery is remote via email or web, exploitation is gated by user interaction - the victim must open the crafted document - and the resulting impact is bounded by that user's privileges. No public exploit code has been identified at time of analysis and the vendor has released patches, so this is a patching-priority item rather than a confirmed actively exploited or wormable remote flaw.
Local privilege escalation in Microsoft Office Click-To-Run (C2R) arises from a time-of-check time-of-use race condition in the installer/updater's file handling, letting an authorized low-privileged local user substitute attacker-controlled content in the window between validation and use and thereby gain higher privileges on the host. The flaw is rated CVSS 3.1 base 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is strictly local, requires a pre-existing authenticated session, needs no victim interaction, but is timing-dependent and therefore probabilistic - repeated attempts may be needed to win the race. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a privilege-escalation primitive for an attacker who already holds a local foothold rather than a remotely reachable or actively exploited issue. Deployments affected are Microsoft 365 Apps for Enterprise installed via Click-To-Run (reported as version 16.0.1).
Heap-based buffer overflow in Microsoft Excel enables remote, unauthenticated attackers to execute arbitrary code in the context of the logged-on user when the victim opens a maliciously crafted Excel document. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector, no credentials or prior access are required and attack complexity is low, with the only meaningful barrier being the mandatory user interaction of opening the file; Microsoft rates this 8.8 High, and a vendor patch is available from Microsoft (MSRC update guide for CVE-2026-97773). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the broad install base of Microsoft 365 Apps and Office LTSC makes prompt patching important. This is a credible high-priority issue.
Remote code execution in Microsoft Excel affects Office LTSC 2021, LTSC 2024, Office Online Server, Microsoft 365 Apps, and Mac editions when a victim opens a specially crafted spreadsheet (UI:R). An unauthenticated attacker (PR:N) can trigger a double free (CWE-415) to corrupt memory and execute code in the context of the user; no public exploit has been identified. Although high severity (CVSS 8.8), exploitation requires user interaction and is not zero-click, and vendor patches are available.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to run arbitrary code on a victim's machine when the victim opens a maliciously crafted spreadsheet, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021 and LTSC 2024 (Windows and Mac), Office Online Server, and Office 365 for Mac. The defect is a use-after-free memory-corruption issue (CWE-416) rated CVSS 8.8 with full impact to confidentiality, integrity, and availability, but exploitation hinges on the user-interaction prerequisite (CVSS UI:R) of opening the file - it is not a remote code path that fires without a user action. No public exploit code has been identified and there is no CISA KEV confirmation of active exploitation at time of analysis; vendor patches are available, so this is a high-priority but not currently urgent-tier issue given the absence of exploitation signals.
Stack-based buffer overflow in Microsoft Excel allows an unauthenticated remote attacker to execute arbitrary code in the context of the user who opens or previews a specially crafted spreadsheet. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, corresponding Mac editions, and Office Online Server; exploitation requires user interaction (UI:R), and no public exploit was identified at time of analysis. Vendor patches are available, with fixed builds such as 16.0.17932.21056 for Office LTSC 2024.
Heap-based buffer overflow in Microsoft Office Excel lets a remote, unauthenticated attacker execute code when a victim opens or previews a specially crafted Excel workbook in an affected Office build. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/SU/C:H/I:H/A:H means the attacker needs the user to interact with the malicious file, not a server-side or fully unauthenticated service exploit, despite the network attack-vector label. Microsoft has released patches per the MSRC advisory; no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote attackers to execute arbitrary code in the context of the user who opens a specially crafted spreadsheet. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no authentication or prior privileges are required, but exploitation is conditional on the victim opening the malicious file - there is no zero-click path, which is the defining prerequisite and the primary limiting factor. Affected builds span Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 (Windows and Mac), Office LTSC/365 for Mac, and Office Online Server; there is no public exploit identified at time of analysis, and no CISA KEV listing, though Microsoft has published a vendor fix.
Arbitrary code execution in Microsoft Office Excel is possible when a user opens a specially crafted workbook, because the parser mishandles memory and triggers a double free (CWE-415). The flaw is remotely deliverable by an unauthenticated attacker (CVSS 3.1 AV:N/AC:L/PR:N), but exploitation depends on the victim opening the malicious file (UI:R), limiting the attack to social-engineering delivery; successful exploitation runs code with the privileges of the opening user. Affected software includes Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office for Mac builds, and Office Online Server builds below the fixed versions, and a vendor patch is available; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Heap-based buffer overflow in Microsoft Excel allows remote code execution when a victim opens an attacker-crafted spreadsheet in a vulnerable build, including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office for Mac, and Office Online Server. The attack is unauthenticated from the attacker's side but requires user interaction (UI:R), meaning the target must open or preview the file, after which code executes in that user's security context. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, though vendor patches are available and should be treated as a high-priority patch item.
Code execution in Microsoft Excel is possible when an unauthenticated remote attacker convinces a user to open a specially crafted workbook, triggering a heap-based buffer overflow (CWE-122) that can corrupt memory and allow arbitrary code to run in the context of the application. The flaw affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office Online Server, and the listed Mac LTSC/365 builds, with exploitation requiring user interaction to open the document (UI:R). Microsoft has released patched versions for the Windows and server builds, and no public exploit identified at time of analysis.
Remote code execution in Microsoft Excel allows an unauthenticated attacker to compromise affected systems when a victim opens or previews a maliciously crafted workbook. This heap-based buffer overflow affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, and Office Online Server; a vendor patch is available. No public exploit code has been identified at time of analysis, and while exploitation requires user interaction, the vulnerability is high priority but not an emergency 'patch-tonight' situation.
Remote code execution in Microsoft Excel (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows and Mac, Office 365 for Mac, and Office Online Server) allows an unauthenticated remote attacker to execute code with the victim's privileges by convincing them to open or preview a specially crafted workbook. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing, and exploitation hinges on the required user interaction (CVSS UI:R); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis. Microsoft has released patches-Office LTSC 2024 16.0.17932.21056, Office LTSC 2021 16.0.14334.20974, and Office Online Server 16.0.10417.20228-making this a genuine patch-priority item but not a drop-everything emergency.
Stack-based buffer overflow in the Excel document parser allows a remote, unauthenticated attacker to execute code in the context of the current user when a victim opens a maliciously crafted spreadsheet. Exploitation requires user interaction (UI:R) - the file must be opened - and the attacker gains no elevated privileges, with code running locally rather than as SYSTEM or root, though impact to confidentiality, integrity and availability is rated high for that user context. The flaw affects Microsoft Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021/2024, and a vendor patch is available; no public exploit code was identified at time of analysis and exploitation has not been confirmed as active (no CISA KEV listing), so risk is driven by the large Office install base and the ease of delivering a file by email or web rather than by observed attacks.
Memory corruption in Microsoft Excel lets a remote, unauthenticated attacker execute code in the context of the user who opens a specially crafted spreadsheet. The flaw is a use-after-free (CWE-416) triggered while Excel parses the malicious document, and it affects Microsoft 365 Apps for Enterprise, Office LTSC 2024 and 2021 on Windows, and Office/Office LTSC for Mac 2021 and 2024. The decisive limiting factor is the required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8): there is no zero-click or server-side path, so exploitation depends on social engineering to get a victim to open the file; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied. This makes it a genuine high-priority patch item rather than a drop-everything emergency.