Microsoft
Monthly
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
Memory corruption via use-after-free in Microsoft Edge (Chromium-based) lets a remote attacker run arbitrary code at elevated privilege in the browser and ultimately on the host, provided the victim opens attacker-controlled content. Microsoft scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials are needed but a single user visit is — a classic one-click browser exploitation pattern rather than a zero-click worm. The intelligence feed contains no EPSS score, no CISA KEV listing, and no public exploit reference, so at time of analysis this is a high-severity but not yet observed-exploited issue.
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. This is a follow-up to CVE-2026-75156, which fixed the identical missing-validation flaw on the Azure AD path in the same file while leaving the Authentik path untouched; upgrade to 3.9.0 or later to remediate. No public exploit code or active-exploitation telemetry was provided in the source data.
Let me synthesize the analysis for CVE-2026-79993. Key facts: - Apache ZooKeeper deleteContainer opcode (0x14/20) processed without ACL check. - Affected: 3.9.0-3.9.5, 3.8.0-3.8.6. - Fixed in 3.9.6 and 3.8.7. - Any client with plain TCP session on client port 2181, no auth, no ACL permissions, can delete any empty persistent znode (regular persistent, container, TTL nodes). - Skips session check and DELETE ACL check. - Authorization bypass / ACL enforcement bug (CWE-862 Missing Authorization presumably, or CWE-863 Incorrect Authorization). - No CVSS provided, no EPSS, no KEV, no POC. - Credit given. Let me construct fields. Product name: "Apache ZooKeeper" Summary: original synthesis. Start with impact verb + product. "Unauthorized deletion of znodes in Apache ZooKeeper 3.8.x and 3.9.x..." Technical context: ZooKeeper coordination kernel, znodes, ACLs, opcodes, container nodes, TTL nodes. CWE-862/CWE-863. The deleteContainer opcode is internal-only, used by servers to remove container nodes when they become empty. The regular DELETE path (opcode 2) enforces session check and ACL. deleteContainer path skips both. Note: description says "allowing any authenticated client" but then says "with NO authentication and NO ACL permissions". Conflicting. Actually the description contradicts itself: "allowing any authenticated client" vs "with NO authentication". Hmm. The plain TCP session means anyone with network access to port 2181 — no authentication needed. So PR:N effectively. But wait—can they delete any znode? The check is on empty persistent znodes. Actually the description says deleteContainer can delete "any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes)". So condition: znode must be empty (no children). Actually deleteContainer opcode normally deletes container nodes; here it can delete any empty persistent znode. So prerequisite: target znode must have zero children. CVSS assessment: AV:N, AC:L, PR:N (no auth n
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
URL path injection in the Lokka MCP server for Microsoft 365 (versions prior to 2.1.2) allows a crafted path value passed to the Lokka-Microsoft tool to break out of the management.azure.com base URL, causing a valid Azure Resource Manager bearer token to be transmitted to an attacker-controlled host. The flaw is a classic server-side request forgery / token-exfiltration pattern (CWE-918) caused by string concatenation instead of the standard URL API when building ARM request URLs. The vendor fixed it in 2.1.2 by validating Azure paths and composing URLs via the URL constructor; no public exploit code or CISA KEV entry was identified in the provided intelligence, so exploitation is currently assessed as requiring attacker-controlled input (for example indirect prompt injection) into the tool's path argument.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Privilege escalation in Microsoft Windows 11 version 26H1 stems from a double-free (CWE-415) in Secure Kernel Mode that lets a locally authenticated attacker holding high privileges corrupt kernel memory and reach an execution context above the normal kernel boundary. Successful exploitation yields complete loss of confidentiality, integrity, and availability for the affected component and the assets it protects (CVSS 8.2, S:C), effectively bypassing VBS-backed protections. No public exploit code or active exploitation is currently identified, and SSVC rates exploitation as 'none' and automatable as 'no'; Microsoft has released a patch in the 10.0.28000.2956 servicing build.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows a low-privileged authenticated attacker to gain full system control via improper symlink/junction resolution (CWE-59). Affected platforms include Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires local access and a race condition (AC:H), making this a targeted rather than opportunistic threat; no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Command injection (CWE-77) in Microsoft Azure CLI versions 1.0.0 through 2.2.0 allows a low-privilege authenticated attacker to execute arbitrary commands over a network when user interaction is obtained. The Scope Changed attribute in the CVSS vector indicates injected commands can break out of the CLI security context and affect resources beyond the immediate process - likely Azure resource management operations or the underlying host OS. Vendor patch is available at version 2.2.1; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) allows an already-authenticated network attacker to gain elevated privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw lets a low-privileged principal act beyond its authorized role, with high confidentiality and integrity impact reaching resources outside the initially vulnerable component. No public exploit identified at time of analysis; the issue is documented solely in Microsoft's MSRC update guide and is remediated by Microsoft server-side rather than by a customer-installed patch.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Privilege escalation in Windows 11 Secure Kernel Mode (Virtualization-Based Security / VTL1) allows a locally authorized attacker with high privileges to cross the VBS isolation boundary and achieve full C:H/I:H/A:H impact on the Secure Kernel context. The root cause is CWE-822 (Untrusted Pointer Dereference): attacker-controlled pointer values are dereferenced without validation inside Secure Kernel Mode, enabling code execution at the VTL1 trust level. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available for Windows 11 26H1.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave exposes authenticated local attackers to full system compromise via an untrusted pointer dereference (CWE-822). Affected platforms include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both standard and Server Core configurations, with Microsoft confirming a patch is available. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (AC:L) makes post-access escalation straightforward for any attacker holding a standard local session.
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority.
Heap-based buffer overflow in Microsoft Office Excel allows a local attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability spans a wide range of currently supported Office releases - Excel 2016 through Microsoft 365 Apps for Enterprise, plus Office for Mac editions - making the attack surface broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has issued patches across all affected channels.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 editions, including Mac variants. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel's file-parsing engine allows code execution when a victim opens a specially crafted workbook. Affected builds span Excel 2016 through Office LTSC 2024 and their Mac equivalents, making the exposure broad across both perpetual-license and subscription deployments. No public exploit code has been identified at time of analysis, but Microsoft has released patched builds for all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Heap-based buffer overflow in Microsoft's Graphics Component enables remote code execution across a broad swath of Windows operating system versions and Microsoft Office products. An unauthenticated network attacker who delivers a specially crafted file can trigger the overflow when the victim opens or renders the content, achieving full C:H/I:H/A:H compromise of the affected system. No public exploit code or CISA KEV listing is associated at time of analysis, but the breadth of affected products - spanning every supported Windows release and multiple Office generations - makes this a high-priority patching target.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution when a user opens a specially crafted workbook. The vulnerability (CWE-121) spans a wide range of Office suites from 2016 through 2024 LTSC on both Windows and macOS. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the broad affected surface - including Microsoft 365 Apps for Enterprise - makes patching a priority for enterprise environments.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document. The flaw affects a broad swath of Office product lines - Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/LTSC 2024 on Windows, and Office for Mac variants - with vendor patches available at specific build thresholds. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of patched-but-unconfirmed-exploited, though the enormous deployment footprint and phishing-friendly delivery model elevate real-world priority.
Heap-based buffer overflow in Microsoft Excel enables local code execution with full user-level privileges when a victim opens a specially crafted workbook file. Affected products span the entire current Office portfolio - Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the broad install base and file-delivery attack path make it a meaningful phishing vector.
Double-free memory corruption (CWE-415) in Microsoft Excel enables local arbitrary code execution across a wide range of Office product lines including Excel 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An attacker who delivers a specially crafted Excel workbook and convinces a target user to open it can achieve arbitrary code execution in the user's security context, with high confidentiality, integrity, and availability impact. Vendor-released patches are available for all Windows Office variants; no public exploit and no CISA KEV listing have been identified at the time of analysis.
Integer overflow in Microsoft Excel's file parsing engine allows an unauthenticated attacker who delivers a specially crafted Excel workbook to execute arbitrary code with the privileges of the victim user upon file opening. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC variants on both Windows and macOS. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected product lines.
Heap-based buffer overflow (CWE-122) in Microsoft Office Excel allows a local, unauthenticated attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability affects a broad range of Office releases spanning Excel 2016 through Office LTSC 2024, on both Windows and macOS. Microsoft has released patches addressing this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across nine distinct Office SKUs ranging from Excel 2016 through Microsoft 365 Apps for Enterprise. Exploitation requires a victim to open a specially crafted Excel file, making phishing and malicious-document delivery the primary attack vectors. Microsoft has released patched builds for all affected Windows variants; Mac-platform fixed builds should be confirmed via the MSRC advisory. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook. The vulnerability (CWE-122) affects all major Office perpetual and subscription editions across Windows and Mac, spanning Excel 2016 through Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, but the file-open trigger and full C/I/A impact make this a high-priority patch for organizations relying on email-delivered spreadsheets.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution at the current user's privilege level when a victim opens a specially crafted workbook file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 across both Windows and Mac platforms, making the potential victim population extremely large. Microsoft has released patches via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span the full Office portfolio - Excel 2016, Office 2019, 2021, 2024 LTSC editions, and Microsoft 365 Apps for Enterprise on both Windows and Mac. An attacker who can convince a user to open a malicious workbook can achieve full C:H/I:H/A:H compromise of the victim's session. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook, affecting all major Office product lines from Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. The vulnerability carries a CVSS 7.8 score reflecting high CIA impact against the Office process, with mandatory user interaction (opening the malicious file) as the sole prerequisite. Microsoft has released patches for all supported versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.
Remote code execution in Microsoft Office Publisher allows a network-based attacker to execute arbitrary code on a victim's machine by exploiting unsafe deserialization of untrusted data in Publisher file parsing. Affected products span the full Office ecosystem including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Publisher 2016, and Office 2019. Exploitation requires user interaction - the victim must open a crafted Publisher file - but no authentication or elevated privileges are needed from the attacker's side. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Information disclosure in Visual Studio Code allows an unauthenticated remote attacker to exfiltrate sensitive data via a crafted file or workspace that triggers incorrect name or reference resolution (CWE-706). Affected versions span 1.0.0 through all releases before 1.136.2. The scope change (S:C) in the CVSS vector indicates the confidentiality impact reaches beyond the VS Code process itself - potentially exposing system files, environment variables, or workspace secrets to a remote origin. No public exploit code or KEV listing is identified at time of analysis, but the broad affected version range and VS Code's developer-centric user base make this a meaningful supply-chain adjacent risk.
Insufficient protection of stored or transmitted credentials in GitHub Copilot and Visual Studio Code before 1.136.2 allows a network-positioned attacker to disclose sensitive information, including authentication tokens, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Microsoft (secure@microsoft.com) is the assigning CNA and a vendored patch is available, but CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is only 0.62% (47th percentile), indicating elevated theoretical severity without observed attacker activity. No public exploit code has been identified at time of analysis.
Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.
Security feature bypass in Visual Studio Code (versions 1.0.0 through below 1.136.2) allows a remote unauthenticated attacker to circumvent a protective security control via an interpretation conflict in the editor's processing pipeline. The vulnerability requires user interaction (UI:R) - a victim must open or interact with attacker-influenced content - after which the scope change (S:C) and high confidentiality impact suggest sensitive host data or credentials may be exfiltrated beyond the process boundary. No public exploit or CISA KEV listing has been identified at time of analysis.
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a protection mechanism when a user is lured into interacting with malicious content (UI:R). Rooted in an incomplete comparison that omits required factors (CWE-693), the flaw carries a scope-changed CVSS 9.6 with full confidentiality, integrity, and availability impact, consistent with a trust/security-control bypass that can extend beyond the editor's initial boundary. A vendor patch exists; no public exploit is identified at time of analysis.
Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.
The @jitsi/electron-sdk package before 10.0.5 bridges the getDesktopSources() API into the meeting page and lets any script running there invoke the jitsi-screen-sharing-get-sources IPC route to pull desktop thumbnails of every screen and window, without a getDisplayMedia() picker being open and without any OS-level screen-recording permission prompt or user consent. The flaw (CWE-862, missing authorization) affects the Jitsi Meet Electron desktop client and any application embedding the SDK, and it is reachable unauthenticated from inside a meeting by a malicious participant or injected script. The vendor fix is a merged upstream PR (PR #516) shipping in 10.0.5; no public exploit code or CISA KEV listing was identified at time of analysis.
Memory corruption via use-after-free in Microsoft Edge (Chromium-based) lets a remote attacker run arbitrary code at elevated privilege in the browser and ultimately on the host, provided the victim opens attacker-controlled content. Microsoft scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials are needed but a single user visit is — a classic one-click browser exploitation pattern rather than a zero-click worm. The intelligence feed contains no EPSS score, no CISA KEV listing, and no public exploit reference, so at time of analysis this is a high-severity but not yet observed-exploited issue.
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
The Apache Airflow FAB provider (apache-airflow-providers-fab) before 3.9.0 fails to validate the issuer and audience claims of id_tokens presented to its Authentik OAuth login path, so any token that the same Authentik deployment minted for a different client application is accepted by Airflow and authenticates the attacker as the user named in that token. Only deployments running the FAB auth manager with Authentik OAuth against an Authentik instance that also serves other applications are affected — the attacker needs a valid token for one of those other apps, not for Airflow itself. This is a follow-up to CVE-2026-75156, which fixed the identical missing-validation flaw on the Azure AD path in the same file while leaving the Authentik path untouched; upgrade to 3.9.0 or later to remediate. No public exploit code or active-exploitation telemetry was provided in the source data.
Let me synthesize the analysis for CVE-2026-79993. Key facts: - Apache ZooKeeper deleteContainer opcode (0x14/20) processed without ACL check. - Affected: 3.9.0-3.9.5, 3.8.0-3.8.6. - Fixed in 3.9.6 and 3.8.7. - Any client with plain TCP session on client port 2181, no auth, no ACL permissions, can delete any empty persistent znode (regular persistent, container, TTL nodes). - Skips session check and DELETE ACL check. - Authorization bypass / ACL enforcement bug (CWE-862 Missing Authorization presumably, or CWE-863 Incorrect Authorization). - No CVSS provided, no EPSS, no KEV, no POC. - Credit given. Let me construct fields. Product name: "Apache ZooKeeper" Summary: original synthesis. Start with impact verb + product. "Unauthorized deletion of znodes in Apache ZooKeeper 3.8.x and 3.9.x..." Technical context: ZooKeeper coordination kernel, znodes, ACLs, opcodes, container nodes, TTL nodes. CWE-862/CWE-863. The deleteContainer opcode is internal-only, used by servers to remove container nodes when they become empty. The regular DELETE path (opcode 2) enforces session check and ACL. deleteContainer path skips both. Note: description says "allowing any authenticated client" but then says "with NO authentication and NO ACL permissions". Conflicting. Actually the description contradicts itself: "allowing any authenticated client" vs "with NO authentication". Hmm. The plain TCP session means anyone with network access to port 2181 — no authentication needed. So PR:N effectively. But wait—can they delete any znode? The check is on empty persistent znodes. Actually the description says deleteContainer can delete "any empty persistent znode (including regular persistent nodes, container nodes, and TTL nodes)". So condition: znode must be empty (no children). Actually deleteContainer opcode normally deletes container nodes; here it can delete any empty persistent znode. So prerequisite: target znode must have zero children. CVSS assessment: AV:N, AC:L, PR:N (no auth n
MCPVault, a lightweight Model Context Protocol server that exposes Obsidian vault files to AI agents, fails to block access to restricted directories such as .git, .obsidian, and node_modules in versions prior to 0.11.4. PathFilter compiles its deny-list patterns case-sensitively and matches raw path segments, so on case-insensitive macOS and Windows filesystems variants like .Git/config or .GIT/config (and on Windows, trailing-dot/space forms such as .git./config) pass both isAllowed() and isAllowedForListing() while the operating system still opens the real restricted directory. An attacker who can influence a path selected by an AI agent can then read, write, move, search, or list sensitive repository and Obsidian metadata; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 3.1 base score is 8.8.
URL path injection in the Lokka MCP server for Microsoft 365 (versions prior to 2.1.2) allows a crafted path value passed to the Lokka-Microsoft tool to break out of the management.azure.com base URL, causing a valid Azure Resource Manager bearer token to be transmitted to an attacker-controlled host. The flaw is a classic server-side request forgery / token-exfiltration pattern (CWE-918) caused by string concatenation instead of the standard URL API when building ARM request URLs. The vendor fixed it in 2.1.2 by validating Azure paths and composing URLs via the URL constructor; no public exploit code or CISA KEV entry was identified in the provided intelligence, so exploitation is currently assessed as requiring attacker-controlled input (for example indirect prompt injection) into the tool's path argument.
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint, so any authenticated user holding only read-only membership in a project can read the credential that is supposed to be reserved for the link itself. Because that hash can be exchanged for a link-share JWT carrying the share's own permission level, the disclosure becomes a privilege-escalation primitive: if the leaked share was created with write or admin rights, the attacker inherits them and can modify tasks, projects, or administrative settings. The issue is fixed in 2.6.0 per the vendor advisory, and no CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence at time of analysis.
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Privilege escalation in Microsoft Windows 11 version 26H1 stems from a double-free (CWE-415) in Secure Kernel Mode that lets a locally authenticated attacker holding high privileges corrupt kernel memory and reach an execution context above the normal kernel boundary. Successful exploitation yields complete loss of confidentiality, integrity, and availability for the affected component and the assets it protects (CVSS 8.2, S:C), effectively bypassing VBS-backed protections. No public exploit code or active exploitation is currently identified, and SSVC rates exploitation as 'none' and automatable as 'no'; Microsoft has released a patch in the 10.0.28000.2956 servicing build.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network denial-of-service in Microsoft Skype for Business Server allows a remote attacker to crash the service by triggering an integer underflow (CWE-191) in network-facing processing code. Affected are Skype for Business Server 2015, 2019, and the Subscription Edition across specific cumulative update baselines. SSVC marks the vulnerability automatable with exploitation status none at time of analysis, and no public exploit code has been identified.
Remote code execution in Microsoft Skype for Business Server (2015 CU13, 2019 CU8, and Subscription Edition CU1) lets an unauthenticated network attacker run arbitrary code by controlling a file name or path processed by the server (CWE-73). The flaw was reported by Microsoft's own MSRC team and a patch is available; there is no public exploit identified at time of analysis and no CISA KEV listing, but the pre-authentication, network-reachable RCE profile makes it a top-priority patch for any on-premises deployment.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Local privilege escalation in the Windows Resilient File System (ReFS) Deduplication Service allows a low-privileged authenticated attacker to gain full system control via improper symlink/junction resolution (CWE-59). Affected platforms include Windows Server 2025 and Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires local access and a race condition (AC:H), making this a targeted rather than opportunistic threat; no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker to escalate privileges to SYSTEM level on affected Windows 11 and Windows Server releases. The CWE-121 flaw allows crafted input to overflow a fixed-size stack buffer in a privileged graphics subsystem component, corrupting control flow and achieving full C:H/I:H/A:H impact. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows a locally authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows 11 and Windows Server 2025 builds. The CWE-122 flaw resides in the ReFS kernel driver and requires no user interaction, making it a reliable local privilege escalation primitive when combined with any initial-access vector. Microsoft has released patches via MSRC; no public exploit code or active CISA KEV listing has been identified at time of analysis.
Command injection (CWE-77) in Microsoft Azure CLI versions 1.0.0 through 2.2.0 allows a low-privilege authenticated attacker to execute arbitrary commands over a network when user interaction is obtained. The Scope Changed attribute in the CVSS vector indicates injected commands can break out of the CLI security context and affect resources beyond the immediate process - likely Azure resource management operations or the underlying host OS. Vendor patch is available at version 2.2.1; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Kernel enables any authenticated local user to gain SYSTEM-level access through a missing authorization check (CWE-862). The vulnerability spans a broad range of actively supported Windows releases - including Windows 10 1809 through Windows 11 26H1 and Windows Server 2019, 2022, and 2025 - making the affected surface extremely wide. Microsoft has released patched builds via the MSRC update guide; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) allows an already-authenticated network attacker to gain elevated privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw lets a low-privileged principal act beyond its authorized role, with high confidentiality and integrity impact reaching resources outside the initially vulnerable component. No public exploit identified at time of analysis; the issue is documented solely in Microsoft's MSRC update guide and is remediated by Microsoft server-side rather than by a customer-installed patch.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Privilege escalation in Windows 11 Secure Kernel Mode (Virtualization-Based Security / VTL1) allows a locally authorized attacker with high privileges to cross the VBS isolation boundary and achieve full C:H/I:H/A:H impact on the Secure Kernel context. The root cause is CWE-822 (Untrusted Pointer Dereference): attacker-controlled pointer values are dereferenced without validation inside Secure Kernel Mode, enabling code execution at the VTL1 trust level. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available for Windows 11 26H1.
Local privilege escalation in Windows Virtualization-Based Security (VBS) Enclave exposes authenticated local attackers to full system compromise via an untrusted pointer dereference (CWE-822). Affected platforms include Windows 11 versions 23H2 through 26H1 and Windows Server 2025 in both standard and Server Core configurations, with Microsoft confirming a patch is available. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (AC:L) makes post-access escalation straightforward for any attacker holding a standard local session.
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority.
Heap-based buffer overflow in Microsoft Office Excel allows a local attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability spans a wide range of currently supported Office releases - Excel 2016 through Microsoft 365 Apps for Enterprise, plus Office for Mac editions - making the attack surface broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has issued patches across all affected channels.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 editions, including Mac variants. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel's file-parsing engine allows code execution when a victim opens a specially crafted workbook. Affected builds span Excel 2016 through Office LTSC 2024 and their Mac equivalents, making the exposure broad across both perpetual-license and subscription deployments. No public exploit code has been identified at time of analysis, but Microsoft has released patched builds for all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Office Excel's file-parsing engine enables local code execution when a victim opens a specially crafted spreadsheet. Affects a wide range of Microsoft Office products from version 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, on both Windows and Mac platforms. No public exploit identified at time of analysis, but the low attack complexity combined with full confidentiality, integrity, and availability impact makes phishing-delivered document lures a realistic and proven delivery vector.
Heap-based buffer overflow in Microsoft's Graphics Component enables remote code execution across a broad swath of Windows operating system versions and Microsoft Office products. An unauthenticated network attacker who delivers a specially crafted file can trigger the overflow when the victim opens or renders the content, achieving full C:H/I:H/A:H compromise of the affected system. No public exploit code or CISA KEV listing is associated at time of analysis, but the breadth of affected products - spanning every supported Windows release and multiple Office generations - makes this a high-priority patching target.
Use-after-free code execution in Microsoft Excel allows a local unauthenticated attacker to execute arbitrary code at the privilege level of the victim user by enticing them to open a specially crafted workbook file. Affected products span the full current Office portfolio: Excel 2016, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise. No public exploit or CISA KEV listing is identified at time of analysis, but Microsoft has released patches addressing all affected version lines.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution when a user opens a specially crafted workbook. The vulnerability (CWE-121) spans a wide range of Office suites from 2016 through 2024 LTSC on both Windows and macOS. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the broad affected surface - including Microsoft 365 Apps for Enterprise - makes patching a priority for enterprise environments.
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document. The flaw affects a broad swath of Office product lines - Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/LTSC 2024 on Windows, and Office for Mac variants - with vendor patches available at specific build thresholds. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of patched-but-unconfirmed-exploited, though the enormous deployment footprint and phishing-friendly delivery model elevate real-world priority.
Heap-based buffer overflow in Microsoft Excel enables local code execution with full user-level privileges when a victim opens a specially crafted workbook file. Affected products span the entire current Office portfolio - Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise - on both Windows and macOS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the broad install base and file-delivery attack path make it a meaningful phishing vector.
Double-free memory corruption (CWE-415) in Microsoft Excel enables local arbitrary code execution across a wide range of Office product lines including Excel 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An attacker who delivers a specially crafted Excel workbook and convinces a target user to open it can achieve arbitrary code execution in the user's security context, with high confidentiality, integrity, and availability impact. Vendor-released patches are available for all Windows Office variants; no public exploit and no CISA KEV listing have been identified at the time of analysis.
Integer overflow in Microsoft Excel's file parsing engine allows an unauthenticated attacker who delivers a specially crafted Excel workbook to execute arbitrary code with the privileges of the victim user upon file opening. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC variants on both Windows and macOS. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected product lines.
Heap-based buffer overflow (CWE-122) in Microsoft Office Excel allows a local, unauthenticated attacker to execute arbitrary code with the privileges of the victim user by convincing them to open a specially crafted Excel file. The vulnerability affects a broad range of Office releases spanning Excel 2016 through Office LTSC 2024, on both Windows and macOS. Microsoft has released patches addressing this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span nearly every current Office release line - Excel 2016, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office Online Server. An attacker who tricks a user into opening a malicious workbook can achieve full code execution at the victim's privilege level, with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across nine distinct Office SKUs ranging from Excel 2016 through Microsoft 365 Apps for Enterprise. Exploitation requires a victim to open a specially crafted Excel file, making phishing and malicious-document delivery the primary attack vectors. Microsoft has released patched builds for all affected Windows variants; Mac-platform fixed builds should be confirmed via the MSRC advisory. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook. The vulnerability (CWE-122) affects all major Office perpetual and subscription editions across Windows and Mac, spanning Excel 2016 through Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, but the file-open trigger and full C/I/A impact make this a high-priority patch for organizations relying on email-delivered spreadsheets.
Stack-based buffer overflow in Microsoft Office Excel enables arbitrary code execution at the current user's privilege level when a victim opens a specially crafted workbook file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024 across both Windows and Mac platforms, making the potential victim population extremely large. Microsoft has released patches via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution when a victim opens a specially crafted Excel file. Affected products span the full Office portfolio - Excel 2016, Office 2019, 2021, 2024 LTSC editions, and Microsoft 365 Apps for Enterprise on both Windows and Mac. An attacker who can convince a user to open a malicious workbook can achieve full C:H/I:H/A:H compromise of the victim's session. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds.
Stack-based buffer overflow in Microsoft Office Excel enables local code execution when a user opens a specially crafted workbook, affecting all major Office product lines from Excel 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. The vulnerability carries a CVSS 7.8 score reflecting high CIA impact against the Office process, with mandatory user interaction (opening the malicious file) as the sole prerequisite. Microsoft has released patches for all supported versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Excel enables local code execution across all major Office release tracks when a victim opens a maliciously crafted spreadsheet file. The vulnerability is rooted in improper heap memory management during Excel's file parsing routines (CWE-122), resulting in full compromise of confidentiality, integrity, and availability on the victim system. No public exploit code has been identified at time of analysis, but the breadth of affected versions - spanning Office 2016 through Microsoft 365 and Mac variants - makes this a high-priority patch target for enterprise environments.
Remote code execution in Microsoft Office Publisher allows a network-based attacker to execute arbitrary code on a victim's machine by exploiting unsafe deserialization of untrusted data in Publisher file parsing. Affected products span the full Office ecosystem including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021, Publisher 2016, and Office 2019. Exploitation requires user interaction - the victim must open a crafted Publisher file - but no authentication or elevated privileges are needed from the attacker's side. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Information disclosure in Visual Studio Code allows an unauthenticated remote attacker to exfiltrate sensitive data via a crafted file or workspace that triggers incorrect name or reference resolution (CWE-706). Affected versions span 1.0.0 through all releases before 1.136.2. The scope change (S:C) in the CVSS vector indicates the confidentiality impact reaches beyond the VS Code process itself - potentially exposing system files, environment variables, or workspace secrets to a remote origin. No public exploit code or KEV listing is identified at time of analysis, but the broad affected version range and VS Code's developer-centric user base make this a meaningful supply-chain adjacent risk.
Insufficient protection of stored or transmitted credentials in GitHub Copilot and Visual Studio Code before 1.136.2 allows a network-positioned attacker to disclose sensitive information, including authentication tokens, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Microsoft (secure@microsoft.com) is the assigning CNA and a vendored patch is available, but CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is only 0.62% (47th percentile), indicating elevated theoretical severity without observed attacker activity. No public exploit code has been identified at time of analysis.
Security feature bypass in Visual Studio Code before 1.136.2 allows a remote, unauthenticated attacker to circumvent a protection mechanism via a failing-open (CWE-636) code path, resulting in high confidentiality impact and limited integrity impact across a changed scope. The vulnerability is reachable over the network with low complexity but requires user interaction, suggesting an attacker must induce the victim to open a crafted workspace, file, or URI. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Microsoft has released a patch.
Security feature bypass in Visual Studio Code (versions 1.0.0 through below 1.136.2) allows a remote unauthenticated attacker to circumvent a protective security control via an interpretation conflict in the editor's processing pipeline. The vulnerability requires user interaction (UI:R) - a victim must open or interact with attacker-influenced content - after which the scope change (S:C) and high confidentiality impact suggest sensitive host data or credentials may be exfiltrated beyond the process boundary. No public exploit or CISA KEV listing has been identified at time of analysis.
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a protection mechanism when a user is lured into interacting with malicious content (UI:R). Rooted in an incomplete comparison that omits required factors (CWE-693), the flaw carries a scope-changed CVSS 9.6 with full confidentiality, integrity, and availability impact, consistent with a trust/security-control bypass that can extend beyond the editor's initial boundary. A vendor patch exists; no public exploit is identified at time of analysis.
Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.