Microsoft
Monthly
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated attackers to achieve full code execution (C:H/I:H/A:H) by delivering a specially crafted Word document to a target user across all major Office suite versions on both Windows and macOS. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016, with fixed version thresholds confirmed by EUVD. No public exploit or CISA KEV listing identified at time of analysis, but the network-vector, no-auth delivery model is highly attractive for phishing-based initial access campaigns. Vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Word's document-parsing engine enables remote code execution when a victim opens a specially crafted file, yielding full confidentiality, integrity, and availability compromise of the user's session. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and corresponding macOS editions across both x86 and x64 architectures. No public exploit identified at time of analysis, but the AV:N/PR:N/UI:R CVSS pattern is historically associated with rapid phishing-campaign weaponization for Office document vulnerabilities.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation through a double-free memory corruption flaw in Windows Credential Guard affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. An attacker who already holds elevated local privileges on a target system can exploit the CWE-415 defect to escape the Credential Guard security boundary, achieving scope change with high confidentiality, integrity, and availability impact on protected credential stores. No public exploit code and no CISA KEV listing are present at time of analysis; Microsoft has released patches as part of its update guidance.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Security feature bypass in Visual Studio Code before 1.136.2 allows a local attacker to circumvent an input-validation blocklist (CWE-184), resulting in high confidentiality, integrity, and availability impact. The vulnerability requires user interaction - most plausibly opening a crafted workspace or file - but no elevated privileges. Microsoft shipped a vendor patch capping affected versions below 1.136.2; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Unauthenticated remote information disclosure in Windows Failover Cluster exposes sensitive process memory to network attackers via a use of uninitialized resource flaw (CWE-908). Affected builds span Windows Server 2019, 2022, and 2025 as well as Windows 10 Version 1809 - all reachable without credentials per the AV:N/PR:N CVSS vector. Microsoft has released patches through the standard MSRC update guide; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated low-privileged user to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans a wide range of Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, representing effectively the entire current Microsoft ecosystem. Vendor-released patches are available; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Heap-based buffer overflow in Windows' Graphic Fonts component (CWE-122) enables unauthenticated remote attackers to achieve arbitrary code execution on a wide range of Windows client and server editions by inducing a user to open or preview maliciously crafted font data. Affecting 19 distinct Windows product lines from Server 2012 through Windows 11 26H1, the vulnerability carries a CVSS 3.1 score of 8.8 with full C:H/I:H/A:H impact. A vendor-released patch is available via Microsoft's Update Guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Internet Connection Sharing (ICS) service stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction. Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows 11 25H2 and Server 2025. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none, but the flaw is rated total technical impact and automatable, and Microsoft has shipped patches.
Remote code execution in the Windows Netlogon service affects a broad range of Windows client and server releases (Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025), where a stack-based buffer overflow lets an unauthenticated network attacker run arbitrary code. Because Netlogon underpins the secure channel between domain members and domain controllers, exploitation against a DC can lead to full domain compromise. Microsoft has released patches; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Windows DHCP Server (the DHCP role across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free condition that an unauthenticated attacker can trigger over the network to run arbitrary code in the DHCP service context. The flaw carries a CVSS 9.8 with no privileges or user interaction required, and Microsoft has shipped a fix via MSRC; no public exploit has been identified at time of analysis. Because the DHCP server role is a core network infrastructure component, successful exploitation can compromise a service that touches nearly every host on a network segment.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated attackers to achieve full code execution (C:H/I:H/A:H) by delivering a specially crafted Word document to a target user across all major Office suite versions on both Windows and macOS. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016, with fixed version thresholds confirmed by EUVD. No public exploit or CISA KEV listing identified at time of analysis, but the network-vector, no-auth delivery model is highly attractive for phishing-based initial access campaigns. Vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Word's document-parsing engine enables remote code execution when a victim opens a specially crafted file, yielding full confidentiality, integrity, and availability compromise of the user's session. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and corresponding macOS editions across both x86 and x64 architectures. No public exploit identified at time of analysis, but the AV:N/PR:N/UI:R CVSS pattern is historically associated with rapid phishing-campaign weaponization for Office document vulnerabilities.
Heap-based buffer overflow in the Windows Network Connection Broker service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - making it a broad-surface local privilege escalation risk. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches via the standard Patch Tuesday update cycle.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Local privilege escalation in the Windows Modern Execution Server component allows an authenticated low-privileged attacker to gain full system control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases from build 10.0.14393 through 10.0.28000. Microsoft has released patched builds addressing the flaw; no public exploit or CISA KEV listing is identified at time of analysis, though the CVSS AC:H rating suggests exploitation requires precise timing or specific memory state conditions.
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. Vendor-released patches are available via Microsoft's update guide; no public exploit or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation through a double-free memory corruption flaw in Windows Credential Guard affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. An attacker who already holds elevated local privileges on a target system can exploit the CWE-415 defect to escape the Credential Guard security boundary, achieving scope change with high confidentiality, integrity, and availability impact on protected credential stores. No public exploit code and no CISA KEV listing are present at time of analysis; Microsoft has released patches as part of its update guidance.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Remote code execution in Windows Deployment Services (WDS) via a use-after-free memory corruption flaw allows a low-privileged, network-accessible attacker to execute arbitrary code on affected Windows Server installations. Microsoft confirmed the vulnerability across Windows Server 2012 through 2025 and select Windows 10 builds, with patched build versions identified for each release. No active exploitation or public exploit code has been identified at time of analysis, but the full confidentiality/integrity/availability impact of successful exploitation makes this a material patching priority for organizations running WDS.
Privilege escalation via heap-based buffer overflow in the Windows USB driver stack allows a low-privileged local attacker to gain SYSTEM-level access on affected Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) resides in kernel-mode USB driver handling, where malformed or malicious USB-related input can corrupt heap memory and redirect execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the low attack complexity and broad Windows footprint make this a meaningful post-exploitation and insider-threat vector.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
Null pointer dereference in the Windows SMB Server network transport driver (srvnet.sys) enables unauthenticated remote attackers to crash affected Windows systems via a network-based denial-of-service attack. Exploitation requires no credentials and no user interaction, targeting SMB-exposed Windows 11 and Windows Server 2022/2025 endpoints. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the flaw.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in Windows Deployment Services (WDS) allows authenticated network attackers to execute arbitrary code on affected Windows Server hosts ranging from Server 2012 through Server 2025. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but requires at least low-privilege credentials and elevated exploitation complexity, consistent with the description's 'authorized attacker' phrasing. No public exploit code or CISA KEV listing exists at time of analysis; vendor patch is available.
Local privilege escalation via heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables any authorized low-privileged user to achieve full SYSTEM-level compromise across a broad range of Windows desktop and server releases. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity local exploitation with no user interaction, yielding complete confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available.
Remote code execution is achievable in Windows Schannel - Microsoft's built-in TLS/SSL security package - through a heap-based buffer overflow triggered over a network connection. Affected builds span Windows 11 versions 23H2 through 26H1 and Windows Server 2022 and 2025, all prior to Microsoft's patched releases. No public exploit has been identified at time of analysis, but the network-reachable attack surface, low complexity, and fully high-impact CVSS score of 8.8 make this a high-priority patch for any Windows environment relying on Schannel-backed services.
Use-after-free in the Windows SMB Client component enables unauthenticated remote code execution against a broad range of Windows 11 and Windows Server builds. An attacker operating a malicious SMB server can trigger a freed-memory dereference during client-side protocol processing, yielding arbitrary code execution with a full C:H/I:H/A:H impact triad. Microsoft has released cumulative updates addressing the flaw; no CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Buffer over-read in the Windows Message Queuing (MSMQ) Queue Manager allows remote, unauthenticated attackers to disclose arbitrary process memory contents across a broad spectrum of Windows desktop and server versions. The CWE-126 root cause means a crafted MSMQ network message causes the Queue Manager to read past its allocated buffer boundary, potentially returning heap or stack memory-including credentials, session tokens, or application secrets-in network responses. No public exploit code or CISA KEV listing is present at time of analysis; Microsoft has released patches covering Windows Server 2012 through 2025 and Windows 10 through 11.
Local code execution is achievable in Windows Secure Socket Tunneling Protocol (SSTP) across a broad range of Windows 10, Windows 11, and Windows Server releases via a use-after-free memory corruption flaw (CWE-416). An authorized attacker with low-privileged local access and the ability to satisfy high-complexity exploitation conditions can achieve full C/I/A compromise of the local system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected build lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Use-after-free in the Windows DNS Server component on Windows Server 2025 enables an authorized network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 7.5 rating with high attack complexity (AC:H) and low privilege requirements (PR:L), matching Microsoft's framing of an 'authorized attacker,' which constrains opportunistic exploitation. No public exploit code or CISA KEV listing is present at time of analysis; a vendor patch has been released addressing build 10.0.26100.33438.
Privilege escalation in Windows Internet Connection Sharing (ICS) via a use-after-free memory corruption flaw (CWE-416) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control of the host. The vulnerability spans a broad range of Windows client and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit code or CISA KEV listing is present at time of analysis, and the CVSS 7.0 score reflects the mitigating AC:H race-condition requirement that reduces weaponization reliability.
Uncontrolled memory consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows unauthenticated remote attackers to terminate a .NET host process by submitting a small, specially crafted YAML OpenAPI document containing nested anchors and aliases. The attack exploits a 'billion laughs' style amplification at the boundary between SharpYaml's directed acyclic graph representation and System.Text.Json.Nodes.JsonNode materialization: because a JsonNode cannot be shared across parents, each alias must be deep-copied independently, yielding k^N allocations for N nested anchor levels each referenced k times. No public exploit has been identified at time of analysis, but SSVC confirms the attack is automatable, meaning tooling can deliver it at scale once a payload is known.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an authorized local attacker with low privileges to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) reflects that exploitation requires local access and elevated complexity, limiting opportunistic automated attacks but not targeted use. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected product lines.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Local privilege escalation in Windows Routing and Remote Access Service (RRAS) via a double-free memory corruption flaw (CWE-415) allows an attacker with low-privileged local access to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires high attack complexity, consistent with the race-condition or precise heap-state manipulation typically needed to weaponize double-free primitives. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local code execution with full system impact on unpatched Windows 10, 11, and Server 2012-2025 systems. Any authenticated local user with low privileges can trigger the CWE-122 overflow with no user interaction, achieving high confidentiality, integrity, and availability impact - characteristic of a local privilege escalation to SYSTEM or service-level code execution. No active exploitation (KEV) or public proof-of-concept is confirmed at time of analysis; vendor patch is available via Microsoft Update.
Privilege escalation via use-after-free in Windows Remote Access Connection Manager (RASMAN) permits a locally authenticated attacker with low-level access to gain full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows client and server ecosystem, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Privilege escalation via stack-based buffer overflow in the Windows Storage Management Provider affects Windows 10, Windows 11, and Windows Server 2022/2025 across multiple build versions. A locally authenticated attacker with low privileges can exploit CWE-121 to overflow a stack buffer within the Storage Management Provider component, achieving full SYSTEM-level privilege escalation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage across both client and server Windows editions make patching a priority.
Remote code execution is achievable in the Windows Work Folder Service via a CWE-190 integer overflow that allows a low-privileged authenticated attacker to trigger arbitrary code execution over the network. Affected platforms span Windows Server 2012 R2 through Windows Server 2025 and Windows 10 versions 1607 and 1809, covering the majority of actively maintained Windows Server generations. Microsoft has released patched builds for all affected versions; no public exploit or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NFS Portmapper affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1, allowing a low-privileged local user to achieve full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity once local access is established, with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected versions.
Local privilege escalation in Windows Remote Access Connection Manager (RACM) exploits a use-after-free memory corruption flaw to allow an authorized low-privileged user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft platforms - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it widely applicable across enterprise environments. Microsoft has released patches addressing the flaw; no public exploit code or CISA KEV listing is present at time of analysis, though the CVSS AC:H rating suggests reliable exploitation requires a race-condition timing window.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when a victim user interacts with attacker-supplied content, yielding full compromise of confidentiality, integrity, and availability. The vulnerability spans multiple .NET Long-Term Support and current release trains (8.0, 9.0, 10.0, 11.0), significantly broadening the attack surface beyond the IDE to include build servers and CI/CD pipelines ingesting .NET artifacts. Reported through Microsoft's MSRC channel (secure@microsoft.com) with a vendor patch now available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Information disclosure in Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to unauthenticated network attackers across a vast range of Windows Server and client editions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is improper null termination (CWE-170), a memory safety defect where string buffers are read beyond their intended boundary, leaking adjacent memory to a remote caller before any authentication handshake completes. No public exploit or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and breadth of affected systems make this a high-priority patch for any organization with RDP exposed.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Local code execution in the Windows Services for NFS ONCRPC XDR Driver via a use-after-free (CWE-416) allows a low-privileged local attacker to achieve full system compromise (C:H/I:H/A:H) on all supported Windows Server releases from 2012 through 2025. Exploitation is constrained by high attack complexity (AC:H), typical of race-condition UAF primitives in kernel drivers. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Biometric Service (WBioSrvc) allows a locally authenticated attacker to elevate from standard user to SYSTEM-level privileges via an integer overflow or wraparound condition. The flaw spans a wide range of Windows 10, 11, and Server editions (1607 through 25H2/Server 2025), making it applicable across the majority of actively managed Windows fleets. With a CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) and low attack complexity once local access is established, this vulnerability is a realistic post-exploitation escalation primitive; no public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Mobile Broadband driver stack enables unauthenticated remote attackers to disclose sensitive memory contents over a cellular network connection. Affected systems span Windows 10 (21H2, 22H2) and Windows 11 (23H2 through 26H1) before their respective patched builds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS PR:N/AV:N vector indicates no authentication or user interaction is required for exploitation.
Heap-based buffer overflow in Windows Credential Guard enables a local low-privileged attacker to escalate privileges to full system control across multiple Windows 10 and Windows 11 releases. The vulnerability (CWE-122) resides in the virtualization-based security component responsible for isolating credential material, meaning successful exploitation can directly undermine the primary defense protecting NTLM hashes and Kerberos tickets. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation across a broad swath of Windows 10, 11, and Server releases. An authenticated local attacker exploiting this flaw can achieve full compromise of confidentiality, integrity, and availability on the target system, consistent with elevation to SYSTEM-level privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; attack complexity is rated High, limiting the practical threat pool to skilled or persistent local actors.
Privilege escalation to SYSTEM in Windows Biometric Service (wbiosrvc) allows a locally authenticated low-privileged user to fully compromise the affected Windows host via an integer overflow (CWE-190) in the biometric framework's internal processing. The flaw spans a broad surface of Microsoft Windows client and server editions from Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-After-Free (CWE-416) in the Windows Routing and Remote Access Service enables an unauthenticated attacker positioned on an adjacent network to execute arbitrary code on affected Windows systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025 and Windows 10/11 client versions, making the exposure surface substantial in enterprise environments where RRAS is deployed as a VPN or routing endpoint. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H/A:H impact and adjacent-network unauthenticated attack path make it a high-priority patching target for organizations running RRAS-enabled servers.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Heap-based buffer overflow in the Windows Defender Firewall Service (mpssvc) allows an authenticated local attacker holding only standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability spans every major Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, covering both client and server deployments. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Privilege escalation in the Windows Display Enhancement Service (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a locally authenticated low-privileged attacker to gain elevated privileges through exploitation of a double-free memory corruption flaw (CWE-415). The vulnerability requires local access and high attack complexity, reflecting the precision required to reliably trigger and exploit heap corruption. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Privilege escalation in the Windows AF_UNIX Socket Provider allows a local low-privileged attacker to gain full system-level control via a use-after-free memory corruption flaw. The vulnerability spans virtually all supported and some legacy Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it extremely broad in scope. No public exploit or CISA KEV listing has been identified at time of analysis, but the high-complexity local exploitation bar and the completeness of C:H/I:H/A:H CVSS impact make this a meaningful privilege-escalation risk in multi-tenant, shared, or endpoint environments.
Heap-based buffer overflow in the Windows Print Spooler Components (spoolsv.exe) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The flaw spans an exceptionally wide swath of Microsoft's product portfolio - from legacy Windows Server 2012 through current Windows 11 26H1 and Windows Server 2025 - making patch coverage a substantial operational challenge. Microsoft has released fixes via its update guide; no public exploit or CISA KEV listing has been identified at time of analysis, but the component's history of critical vulnerabilities (PrintNightmare, etc.) makes it a high-priority patching target.
Windows Shell's link-resolution logic fails to safely handle symbolic or hard links before granting file access, enabling a remote unauthenticated attacker to perform network-based spoofing against a victim who interacts with a crafted payload. The flaw (CWE-59) spans the full current Windows ecosystem - from Server 2012 R2 through Windows 11 26H2 and Server 2025 - and can yield both confidentiality and integrity compromise (C:H/I:H). No public exploit or CISA KEV listing has been identified at time of analysis, but user interaction (UI:R) is the sole barrier to exploitation.
Privilege escalation in Windows Audio Service across all current Windows releases exploits a double-free memory corruption condition (CWE-415) to allow a low-privileged local user to gain full system control. The flaw spans Windows 10, 11, and every supported Windows Server generation from 2012 through 2025. Microsoft has released patches as part of its update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Microsoft WebP Image Extension versions prior to 1.2.31.0 enables remote code execution when a victim opens a specially crafted WebP image file. The root trigger is an integer overflow (CWE-190) that corrupts heap allocation sizing, producing a classic CWE-122 heap overflow; the CVSS vector confirms full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high CVSS score (8.8) and complete code-execution impact make patching urgent for any Windows environment where the extension is installed.
Use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) allows network-reachable unauthenticated attackers to elevate privileges to SYSTEM level on affected Windows hosts. The vulnerability spans a broad surface - every supported Windows release from Server 2012 through Windows 11 25H2 and Server 2025 is confirmed affected. SSVC rates exploitation status as none and the attack as non-automatable, but technical impact is total, meaning successful exploitation yields full system compromise. No public exploit or KEV listing has been identified at time of analysis.
Security feature bypass in Visual Studio Code before 1.136.2 allows a local attacker to circumvent an input-validation blocklist (CWE-184), resulting in high confidentiality, integrity, and availability impact. The vulnerability requires user interaction - most plausibly opening a crafted workspace or file - but no elevated privileges. Microsoft shipped a vendor patch capping affected versions below 1.136.2; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'