Microsoft
Monthly
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Cross-site scripting (CWE-79) in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to perform content spoofing by injecting malicious scripts that execute in a victim's browser after user interaction. The scope-changed vector (S:C) indicates injected scripts can affect resources beyond the immediate page context, enabling session manipulation or UI redirection. Microsoft has released an official patch via MSRC; temporal metrics (E:U) confirm no public exploit code has been observed at time of analysis.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Excel allows a local attacker to disclose potentially sensitive process memory when a user opens a crafted Excel workbook. The flaw spans a broad range of Office versions from 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise and Mac variants, making the affected footprint very large. No public exploit code or CISA KEV listing has been identified; exploitation depends on social engineering to deliver a malicious file to the local system.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Out-of-bounds read in Microsoft Excel across Office 2016 through 365 Apps for Enterprise permits a local, unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted spreadsheet file. The vulnerability carries a CVSS 5.5 score reflecting the local delivery requirement and confidentiality-only impact, with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all major Windows Office editions.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in Visual Studio Code (all versions prior to 1.136.2) allows a remote unauthenticated attacker to write files outside the intended restricted directory, achieving high-integrity tampering on the victim's system over a network. The attack requires user interaction - a victim must open or process attacker-controlled content within VS Code - which limits automatability. No active exploitation has been identified; SSVC assessment confirms exploitation status as none with partial technical impact. Microsoft has released a fix in version 1.136.2.
Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. No public exploit code and no active exploitation have been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds memory read in Microsoft Office Word discloses potentially sensitive process memory contents when a victim opens a specially crafted document, affecting Microsoft 365 Apps for Enterprise, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and macOS editions across both Windows and macOS platforms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-delivered, low-complexity information-disclosure flaw requiring user interaction but no attacker-side privileges. Vendor patch is confirmed available via Microsoft MSRC; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (CWE-125) allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts - covering virtually the entire active Office install base. No public exploit code or active exploitation has been identified; SSVC rates the exploitation likelihood as none and technical impact as partial, consistent with the 6.5 CVSS base score.
Out-of-bounds read in Microsoft Word across Office 2016 through Microsoft 365 Apps enables an unauthenticated remote attacker to disclose sensitive memory contents when a user opens a crafted document. The vulnerability (CWE-125) affects both Windows (x86/x64) and macOS deployments of the Office suite across multiple release tracks - retail, LTSC, and subscription. No public exploit or active exploitation has been identified at time of analysis, though the broad install base and socially-engineered document delivery make this a realistic phishing vector.
Heap-based buffer overflow in Microsoft Office leaks sensitive memory contents to unauthenticated network attackers when a victim opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, making the exposure surface extremely broad. Vendor-released patches are available; no public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-privilege vector warrants prompt patching across enterprise fleets.
Out-of-bounds memory read in Microsoft PowerPoint's file-parsing logic exposes sensitive process memory when a victim opens a specially crafted presentation file, allowing a remote unauthenticated attacker to disclose heap or stack contents. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS platforms. Microsoft has released patched builds via the MSRC advisory; no public exploit identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Office Outlook allows a remote unauthenticated attacker to leak process memory contents when a victim opens or previews a crafted email message or attachment. All major Office branches are affected - Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - spanning hundreds of millions of endpoints globally. Microsoft has released patches across all affected branches; no public exploit code exists and CISA SSVC rates exploitation as 'none' at the time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a remote, unauthenticated attacker who can convince a user to open a crafted document. The flaw (CWE-125) affects the full current Office portfolio - Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts - with high confidentiality impact and no integrity or availability consequence. No public exploit identified at time of analysis; vendor-released patches are available for all Windows versions with specific build thresholds.
Out-of-bounds read in Microsoft Office Word's document parser allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a crafted Word file. Affecting Word 2016, Office 2019/2021/2024 LTSC, and Microsoft 365 Apps for Enterprise across both x86 and x64 builds, the vulnerability carries a CVSS 6.5 with C:H but no integrity or availability impact. No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation as none and the attack as not automatable, moderating operational urgency despite the broad product footprint.
Out-of-bounds read in multiple Microsoft Office SKUs allows a remote unauthenticated attacker to disclose in-process memory contents by inducing a user to open a specially crafted document. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC on Windows, and multiple Mac variants. Exploitation yields high confidentiality impact with no integrity or availability consequence; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes arbitrary memory contents to a remote unauthenticated attacker who can convince a user to open a malicious file, resulting in high-confidence information disclosure. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS equivalents. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the phishing-file delivery model is a well-established Office exploitation pattern.
Out-of-bounds read in Microsoft Office Outlook allows a remote, unauthenticated attacker to disclose sensitive information from process memory by inducing a user to open or interact with a maliciously crafted email or document. Affected products span Outlook 2016 through Microsoft 365 Apps for Enterprise, covering a large portion of the enterprise desktop install base. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected product lines via MSRC.
Out-of-bounds read in Microsoft Office Word allows an unauthenticated remote attacker to disclose memory contents when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024 on both x86 and x64 platforms. The flaw (CWE-125) resides in Word's document parser and can expose heap or stack memory to the attacker-controlled document, but is limited strictly to confidentiality impact - no code execution or integrity violation is possible from this flaw alone. Vendor-released patches are available across all affected product lines; no active exploitation has been identified and no public exploit code is known at time of analysis.
Out-of-bounds read in Microsoft Office Outlook and closely related Office suite components exposes sensitive in-memory data to network-based attackers who can deliver a crafted document to a user. The CVSS vector (C:H/I:N/A:N) and CWE-125 (Out-of-bounds Read) align on an information-disclosure primary impact, while Microsoft's description references code execution - a material discrepancy that warrants verification against the full MSRC advisory. Patches are available from Microsoft across all affected product lines including Office 2016 through 2024 LTSC and Microsoft 365 Apps on both Windows and macOS; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables an unauthenticated remote attacker to disclose sensitive memory contents when a victim opens a crafted Excel file. The vulnerability spans a broad range of Office product lines - including Office 2016, 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps for Enterprise, and Mac variants - making the exposure surface wide. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via Microsoft's update guide.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Out-of-bounds read in Microsoft Office Word enables remote attackers to disclose high-value in-process memory contents by convincing a user to open a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Word 2016, Office 2019/2021/2024 LTSC on Windows (x86/x64) and Office for Mac editions, this CWE-125 flaw requires no attacker authentication but does require victim interaction. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery, consistent with the phishing/social-engineering delivery model implied by the UI:R CVSS metric.
Out-of-bounds read (CWE-125) in Microsoft Word's document-parsing engine enables remote information disclosure across Microsoft 365 Apps, Office 2019, 2021, and 2024 LTSC on both Windows and macOS. An unauthenticated remote attacker (per CVSS PR:N) can cause Word to read beyond an allocated buffer when a victim opens a crafted document, potentially leaking sensitive memory contents to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates the attack as non-automatable with partial technical impact, placing this squarely in routine patch-cycle response rather than emergency remediation.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in the Windows OLE DB component affects Microsoft SQL Server 2017 and 2019, enabling a network-based attacker to disclose sensitive memory contents. Exploitation requires user interaction - specifically, a victim client or application must connect to an attacker-controlled OLE DB data source that delivers a crafted response triggering CWE-125. No public exploit exists and CISA SSVC rates exploitation as none, though the CVSS C:H rating reflects the potential for significant memory disclosure against unpatched SQL Server deployments.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Integer underflow (CWE-191) in Microsoft SQL Server enables a locally authenticated, low-privileged attacker to disclose sensitive information from the database engine without requiring user interaction. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both GDR and cumulative update servicing tracks, with Microsoft releasing fixes across all affected branches. No public exploit code or active exploitation has been identified; SSVC scoring places this at Exploitation: none and Automatable: no, reflecting the constrained, local attack surface.
Buffer over-read (CWE-126) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to trigger server-side memory disclosure. The flaw causes the SQL Server engine to read past an allocated buffer boundary and return excess memory contents to the caller over the network connection, potentially exposing in-memory data from other sessions or internal state. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial, making this a moderate-priority patch cycle item.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service against Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 builds is achievable by unauthenticated remote attackers via unthrottled resource allocation (CWE-770). High attack complexity (AC:H) limits trivial or automated exploitation, and SSVC assessment confirms no active exploitation and non-automatable attack patterns. Only availability is impacted; confidentiality and integrity are unaffected. Vendor patch is available through Microsoft MSRC; no public exploits have been identified.
Out-of-bounds read in Microsoft Office PowerPoint exposes memory contents to remote attackers when a victim opens a specially crafted PowerPoint file. Affected products span PowerPoint 2016 through Microsoft 365 Apps for Enterprise across Windows and Mac. No public exploit code has been identified and SSVC classifies exploitation as none and not automatable, consistent with the user-interaction requirement that prevents mass exploitation.
Out-of-bounds read in Microsoft Word across Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise on both Windows and macOS allows a locally authenticated, low-privileged user to disclose adjacent process memory by opening a specially crafted document. The flaw carries a High confidentiality impact with no integrity or availability effects, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation status as none and automation as infeasible.
Out-of-bounds read (CWE-125) in Microsoft PowerPoint exposes memory contents to remote unauthenticated attackers who can convince a user to open a specially crafted presentation file. All major Office release channels are affected, including Microsoft 365 Apps for Enterprise, Office 2019, PowerPoint 2016, Office LTSC 2021, and Office LTSC 2024, on both Windows and Mac platforms. No public exploit or active exploitation has been confirmed; SSVC assessment rates exploitation as none and technical impact as partial, consistent with a CVSS 6.5 medium-severity information disclosure finding.
Buffer over-read (CWE-126) in Microsoft Office Excel's file parsing engine allows remote information disclosure when a user opens a crafted spreadsheet file. Affected versions span Office 2016 through Office 2024 LTSC and Microsoft 365 Apps for Enterprise across Windows and Mac platforms, with fixed builds confirmed for Windows variants per EUVD-2026-73733. No public exploit code has been identified at time of analysis, and SSVC rates current exploitation as none with partial technical impact, consistent with the absence of a CISA KEV listing.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Untrusted pointer dereference in Microsoft Office PowerPoint exposes high-confidentiality memory contents to a remote, unauthenticated attacker who can convince a user to open a specially crafted presentation file. The flaw (CWE-822) allows the application to dereference a pointer sourced from untrusted file data without validation, enabling out-of-bounds or arbitrary memory reads that leak sensitive process memory over a network context. No public exploit code or CISA KEV listing is present at time of analysis, but the high-confidentiality CVSS rating and broad install base across all current Office versions make patch deployment a priority.
Privilege escalation via relative path traversal (CWE-23) affects the Windows DNS Server service across a broad range of Windows Server releases from 2012 through 2025. An authorized local attacker holding high-privilege access can manipulate relative path sequences in the DNS service to reference files or system resources outside the intended directory scope, resulting in full Confidentiality, Integrity, and Availability impact through SYSTEM-level privilege escalation. Microsoft has released patches across all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Type confusion (CWE-822) in Microsoft Office PowerPoint allows a remote unauthenticated attacker to disclose sensitive information from a victim's system by inducing them to open a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and Mac variants of Office across multiple release channels. Vendor-released patches are available for Windows editions with specific fixed build numbers; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in the Windows Winsock networking subsystem enables local privilege escalation to SYSTEM-level on a broad range of Windows client and server releases. An attacker who already holds a high-privileged (but non-SYSTEM) local account can trigger CWE-122 heap corruption through Winsock to achieve full C:H/I:H/A:H impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Buffer overflow in the Panasonic Industry USB Driver for MINAS A5/A6 servo drives allows a local low-privileged attacker to crash Windows on machines running PanaTerm or RTEX LogReader software. The root cause is classic unchecked buffer copy (CWE-120) in the driver component bundled with the affected Panasonic software titles. Impact is limited to availability - a successful exploitation stops the Windows OS, but no confidentiality or integrity impact has been identified.
Cross-site scripting (CWE-79) in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to perform content spoofing by injecting malicious scripts that execute in a victim's browser after user interaction. The scope-changed vector (S:C) indicates injected scripts can affect resources beyond the immediate page context, enabling session manipulation or UI redirection. Microsoft has released an official patch via MSRC; temporal metrics (E:U) confirm no public exploit code has been observed at time of analysis.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.
Cross-site scripting in Microsoft Skype for Business Server enables network-based spoofing against authenticated users across three distinct server product lines. An unauthenticated remote attacker can inject malicious script into a vulnerable web component that executes in a victim's browser upon user interaction, resulting in high-confidentiality-impact session token theft or UI-level spoofing consistent with the CVSS C:H/I:N pairing. Vendor-released patches are confirmed available via MSRC; no public exploit code and no CISA KEV listing exist at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.
Local tampering of the Windows Cloud Files Mini Filter Driver (CldFlt.sys) is possible because the driver exposes a critical function without adequate authentication checks, allowing a low-privileged local attacker to modify protected data or state that would normally require higher authorization. Affecting Windows 10 through Windows 11 and Windows Server 2019 through 2025 across a wide range of builds, the flaw yields a high integrity impact with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing were identified at time of analysis; Microsoft has released patches covering all affected versions.
Buffer over-read (CWE-126) in Microsoft Word's document parsing code allows local disclosure of in-process memory when a victim opens a specially crafted file. All currently-supported Office release lines on Windows - 365 Apps for Enterprise, Office 2019, 2021, 2024 LTSC, and Word 2016 standalone - are affected across both x86 and x64 architectures. No public exploit code has been identified, and SSVC rates exploitation as 'none' with technical impact 'partial', consistent with the moderate CVSS 5.5 rating.
Buffer over-read (CWE-126) in Microsoft Office Word allows local information disclosure when a user opens a specially crafted document, exposing process memory contents with high-confidentiality impact. Affected builds span Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise across both x86 and x64 architectures. No public exploit has been identified at time of analysis, SSVC rates exploitation as none and the attack as non-automatable, and vendor patches are available for all affected product lines.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in Microsoft Excel exposes potentially sensitive in-process memory contents when a user opens a specially crafted workbook. Affects a wide range of Office versions including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office for Mac editions. SSVC assessment rates exploitation as none with non-automatable attack delivery, and Microsoft has released patches addressing all affected branches. No public exploit or CISA KEV listing exists at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Excel allows a local attacker to disclose potentially sensitive process memory when a user opens a crafted Excel workbook. The flaw spans a broad range of Office versions from 2016 through LTSC 2024, including Microsoft 365 Apps for Enterprise and Mac variants, making the affected footprint very large. No public exploit code or CISA KEV listing has been identified; exploitation depends on social engineering to deliver a malicious file to the local system.
Out-of-bounds read in Microsoft Excel allows a local, unauthenticated attacker to disclose potentially sensitive memory contents by convincing a user to open a specially crafted workbook. Affected builds span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, making this a moderate-priority patch-cycle item rather than an urgent emergency.
Sensitive system information disclosure in Microsoft Excel allows a local, unauthenticated attacker to read high-confidentiality data when a victim opens a specially crafted spreadsheet. Affecting Office 2016 through LTSC 2024 on both Windows and Mac, the flaw (CWE-497) exposes internal system data - such as memory layout, environment variables, or path information - to an unauthorized control sphere during file parsing. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read in Microsoft Excel discloses sensitive memory contents when a victim opens a specially crafted Excel file. The vulnerability spans a wide range of affected versions including Excel 2016, Office 2019, LTSC 2021/2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise, making the patch surface broad across enterprise environments. No public exploit or active exploitation has been identified at time of analysis; vendor patch is available via MSRC.
Out-of-bounds read in Microsoft Excel across Office 2016 through 365 Apps for Enterprise permits a local, unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted spreadsheet file. The vulnerability carries a CVSS 5.5 score reflecting the local delivery requirement and confidentiality-only impact, with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all major Windows Office editions.
Uninitialized memory disclosure in Microsoft Excel exposes potentially sensitive heap or stack contents when a victim opens a crafted document, allowing an unauthenticated attacker to read process memory with high confidentiality impact. Affected product lines span Excel 2016 through Microsoft 365 Apps for Enterprise and multiple Mac variants, making this a broad-surface vulnerability. No public exploit code and no CISA KEV listing have been identified at time of analysis; SSVC assessment rates exploitation as 'none' with non-automatable delivery, limiting realistic risk to targeted document-delivery campaigns.
Out-of-bounds read in Microsoft Office Excel's file parser allows local information disclosure when a victim opens a specially crafted workbook. Affecting Excel 2016 through Microsoft 365 Apps for Enterprise, Office LTSC 2024, Office Online Server, and multiple macOS Office variants, the vulnerability (CWE-125) exposes process memory with high confidentiality impact but no integrity or availability consequences. Microsoft has released patched builds via MSRC; SSVC confirms no active exploitation and non-automatable delivery, placing this squarely within standard monthly patch-cycle priority.
Microsoft Office Excel exposes sensitive system information to an unauthorized control sphere (CWE-497), enabling local information disclosure when a victim opens a specially crafted Excel file. The vulnerability spans Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC editions on both Windows and Mac. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the C:H CVSS confidentiality rating indicates the quality or quantity of information that can be exfiltrated is significant.
Command injection (CWE-77) in Visual Studio Code versions prior to 1.136.2 and GitHub Copilot enables a network-based attacker without authentication to trigger disclosure of sensitive information when a targeted developer interacts with specially crafted content. The attack requires high complexity (AC:H) and user interaction (UI:R), yielding a CVSS 5.3 Medium score that reflects real exploitation barriers. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in Visual Studio Code (all versions prior to 1.136.2) allows a remote unauthenticated attacker to write files outside the intended restricted directory, achieving high-integrity tampering on the victim's system over a network. The attack requires user interaction - a victim must open or process attacker-controlled content within VS Code - which limits automatability. No active exploitation has been identified; SSVC assessment confirms exploitation status as none with partial technical impact. Microsoft has released a fix in version 1.136.2.
Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. No public exploit code and no active exploitation have been identified at time of analysis; Microsoft has released patches across all affected product lines.
Out-of-bounds memory read in Microsoft Office Word discloses potentially sensitive process memory contents when a victim opens a specially crafted document, affecting Microsoft 365 Apps for Enterprise, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and macOS editions across both Windows and macOS platforms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-delivered, low-complexity information-disclosure flaw requiring user interaction but no attacker-side privileges. Vendor patch is confirmed available via Microsoft MSRC; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (CWE-125) allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts - covering virtually the entire active Office install base. No public exploit code or active exploitation has been identified; SSVC rates the exploitation likelihood as none and technical impact as partial, consistent with the 6.5 CVSS base score.
Out-of-bounds read in Microsoft Word across Office 2016 through Microsoft 365 Apps enables an unauthenticated remote attacker to disclose sensitive memory contents when a user opens a crafted document. The vulnerability (CWE-125) affects both Windows (x86/x64) and macOS deployments of the Office suite across multiple release tracks - retail, LTSC, and subscription. No public exploit or active exploitation has been identified at time of analysis, though the broad install base and socially-engineered document delivery make this a realistic phishing vector.
Heap-based buffer overflow in Microsoft Office leaks sensitive memory contents to unauthenticated network attackers when a victim opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, making the exposure surface extremely broad. Vendor-released patches are available; no public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-privilege vector warrants prompt patching across enterprise fleets.
Out-of-bounds memory read in Microsoft PowerPoint's file-parsing logic exposes sensitive process memory when a victim opens a specially crafted presentation file, allowing a remote unauthenticated attacker to disclose heap or stack contents. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS platforms. Microsoft has released patched builds via the MSRC advisory; no public exploit identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Office Outlook allows a remote unauthenticated attacker to leak process memory contents when a victim opens or previews a crafted email message or attachment. All major Office branches are affected - Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - spanning hundreds of millions of endpoints globally. Microsoft has released patches across all affected branches; no public exploit code exists and CISA SSVC rates exploitation as 'none' at the time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a remote, unauthenticated attacker who can convince a user to open a crafted document. The flaw (CWE-125) affects the full current Office portfolio - Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts - with high confidentiality impact and no integrity or availability consequence. No public exploit identified at time of analysis; vendor-released patches are available for all Windows versions with specific build thresholds.
Out-of-bounds read in Microsoft Office Word's document parser allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a crafted Word file. Affecting Word 2016, Office 2019/2021/2024 LTSC, and Microsoft 365 Apps for Enterprise across both x86 and x64 builds, the vulnerability carries a CVSS 6.5 with C:H but no integrity or availability impact. No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation as none and the attack as not automatable, moderating operational urgency despite the broad product footprint.
Out-of-bounds read in multiple Microsoft Office SKUs allows a remote unauthenticated attacker to disclose in-process memory contents by inducing a user to open a specially crafted document. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC on Windows, and multiple Mac variants. Exploitation yields high confidentiality impact with no integrity or availability consequence; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes arbitrary memory contents to a remote unauthenticated attacker who can convince a user to open a malicious file, resulting in high-confidence information disclosure. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS equivalents. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the phishing-file delivery model is a well-established Office exploitation pattern.
Out-of-bounds read in Microsoft Office Outlook allows a remote, unauthenticated attacker to disclose sensitive information from process memory by inducing a user to open or interact with a maliciously crafted email or document. Affected products span Outlook 2016 through Microsoft 365 Apps for Enterprise, covering a large portion of the enterprise desktop install base. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected product lines via MSRC.
Out-of-bounds read in Microsoft Office Word allows an unauthenticated remote attacker to disclose memory contents when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps for Enterprise and Office LTSC 2024 on both x86 and x64 platforms. The flaw (CWE-125) resides in Word's document parser and can expose heap or stack memory to the attacker-controlled document, but is limited strictly to confidentiality impact - no code execution or integrity violation is possible from this flaw alone. Vendor-released patches are available across all affected product lines; no active exploitation has been identified and no public exploit code is known at time of analysis.
Out-of-bounds read in Microsoft Office Outlook and closely related Office suite components exposes sensitive in-memory data to network-based attackers who can deliver a crafted document to a user. The CVSS vector (C:H/I:N/A:N) and CWE-125 (Out-of-bounds Read) align on an information-disclosure primary impact, while Microsoft's description references code execution - a material discrepancy that warrants verification against the full MSRC advisory. Patches are available from Microsoft across all affected product lines including Office 2016 through 2024 LTSC and Microsoft 365 Apps on both Windows and macOS; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables an unauthenticated remote attacker to disclose sensitive memory contents when a victim opens a crafted Excel file. The vulnerability spans a broad range of Office product lines - including Office 2016, 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps for Enterprise, and Mac variants - making the exposure surface wide. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via Microsoft's update guide.
Out-of-bounds read in Microsoft Office PowerPoint exposes process memory contents to a local attacker when a victim opens a specially crafted presentation file. Affected across a wide range of Office versions - PowerPoint 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365/Microsoft 365 Apps for Enterprise on both Windows and Mac platforms. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor patch is available.
Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Improper null termination (CWE-170) in Microsoft Office Word's document-processing pipeline allows a local attacker to read beyond a string buffer boundary, disclosing sensitive in-memory data when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and Mac variants across Windows (x64/x86) and macOS. No active exploitation is confirmed (SSVC Exploitation: none; no KEV listing), and Microsoft has released fixed builds across all affected product lines.
Out-of-bounds read in Microsoft Office Word enables remote attackers to disclose high-value in-process memory contents by convincing a user to open a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Word 2016, Office 2019/2021/2024 LTSC on Windows (x86/x64) and Office for Mac editions, this CWE-125 flaw requires no attacker authentication but does require victim interaction. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery, consistent with the phishing/social-engineering delivery model implied by the UI:R CVSS metric.
Out-of-bounds read (CWE-125) in Microsoft Word's document-parsing engine enables remote information disclosure across Microsoft 365 Apps, Office 2019, 2021, and 2024 LTSC on both Windows and macOS. An unauthenticated remote attacker (per CVSS PR:N) can cause Word to read beyond an allocated buffer when a victim opens a crafted document, potentially leaking sensitive memory contents to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates the attack as non-automatable with partial technical impact, placing this squarely in routine patch-cycle response rather than emergency remediation.
Out-of-bounds read in the Xbox component on Windows allows a physically-present attacker to disclose sensitive memory contents. Affecting a wide range of Windows 10 and Windows 11 builds (plus Windows Server 2016/2019), the flaw is triggered via a physical interaction, yielding high confidentiality impact with no integrity or availability consequence. No public exploit code has been identified and CISA SSVC classifies exploitation as none at time of analysis, making this a lower-urgency but patch-worthy item for any endpoint reachable by an untrusted third party.
Out-of-bounds read in the Windows CD-ROM kernel driver enables a local, low-privileged attacker to disclose sensitive kernel memory contents across a broad swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds. The vulnerability is reachable from standard user space - no administrator rights or user interaction required - via crafted I/O control requests to the driver. No public exploit code has been identified and CISA SSVC rates exploitation as none, but kernel memory leakage can serve as a stepping stone in multi-stage privilege-escalation chains.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Out-of-bounds read in the Microsoft Windows SCSI Class System File driver (CWE-125) exposes kernel memory contents to an attacker with physical access to the target machine. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases, from build 10.0.17763 through current 25H2 and Server 2025 lines. No active exploitation or public proof-of-concept has been identified; vendor-released patches are available via the July 2026 Microsoft Security Update.
Privilege escalation via untrusted pointer dereference in the Windows SCSI Class System File affects a broad range of Windows 10, 11, and Windows Server releases, requiring physical access to trigger. An attacker with physical access to a target machine can connect a malicious SCSI device, causing the kernel-mode SCSI class driver to dereference an attacker-controlled pointer and elevate from unprivileged to full system (kernel) control. No public exploit and no CISA KEV listing have been identified at time of analysis; exploitation is constrained to physical proximity.
Use-after-free in Windows Distributed File System (DFS) enables an authenticated network attacker to crash the DFS service, resulting in denial of file-sharing access across affected Windows client and server versions. The CVSS vector (AV:N/AC:H/PR:L) confirms network reachability but constrains exploitation to low-privilege authenticated accounts under high-complexity conditions. Microsoft has released patches covering the full affected range from Windows 10 1607 through Windows Server 2025; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in the Windows OLE DB component affects Microsoft SQL Server 2017 and 2019, enabling a network-based attacker to disclose sensitive memory contents. Exploitation requires user interaction - specifically, a victim client or application must connect to an attacker-controlled OLE DB data source that delivers a crafted response triggering CWE-125. No public exploit exists and CISA SSVC rates exploitation as none, though the CVSS C:H rating reflects the potential for significant memory disclosure against unpatched SQL Server deployments.
Out-of-bounds memory read in Microsoft Office Word's document parser exposes sensitive process memory to remote attackers when a victim opens a specially crafted Word file. The flaw spans Word 2016 through Office LTSC 2024 and Microsoft 365 Apps on both Windows (x86/x64) and macOS. SSVC assessment confirms no known active exploitation and the attack is not automatable, placing real-world priority below the CVSS 6.5 headline score suggests.
Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.
Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.
Integer underflow (CWE-191) in Microsoft SQL Server enables a locally authenticated, low-privileged attacker to disclose sensitive information from the database engine without requiring user interaction. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both GDR and cumulative update servicing tracks, with Microsoft releasing fixes across all affected branches. No public exploit code or active exploitation has been identified; SSVC scoring places this at Exploitation: none and Automatable: no, reflecting the constrained, local attack surface.
Buffer over-read (CWE-126) in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege network attacker to trigger server-side memory disclosure. The flaw causes the SQL Server engine to read past an allocated buffer boundary and return excess memory contents to the caller over the network connection, potentially exposing in-memory data from other sessions or internal state. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial, making this a moderate-priority patch cycle item.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service against Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 builds is achievable by unauthenticated remote attackers via unthrottled resource allocation (CWE-770). High attack complexity (AC:H) limits trivial or automated exploitation, and SSVC assessment confirms no active exploitation and non-automatable attack patterns. Only availability is impacted; confidentiality and integrity are unaffected. Vendor patch is available through Microsoft MSRC; no public exploits have been identified.
Out-of-bounds read in Microsoft Office PowerPoint exposes memory contents to remote attackers when a victim opens a specially crafted PowerPoint file. Affected products span PowerPoint 2016 through Microsoft 365 Apps for Enterprise across Windows and Mac. No public exploit code has been identified and SSVC classifies exploitation as none and not automatable, consistent with the user-interaction requirement that prevents mass exploitation.
Out-of-bounds read in Microsoft Word across Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise on both Windows and macOS allows a locally authenticated, low-privileged user to disclose adjacent process memory by opening a specially crafted document. The flaw carries a High confidentiality impact with no integrity or availability effects, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation status as none and automation as infeasible.
Out-of-bounds read (CWE-125) in Microsoft PowerPoint exposes memory contents to remote unauthenticated attackers who can convince a user to open a specially crafted presentation file. All major Office release channels are affected, including Microsoft 365 Apps for Enterprise, Office 2019, PowerPoint 2016, Office LTSC 2021, and Office LTSC 2024, on both Windows and Mac platforms. No public exploit or active exploitation has been confirmed; SSVC assessment rates exploitation as none and technical impact as partial, consistent with a CVSS 6.5 medium-severity information disclosure finding.
Buffer over-read (CWE-126) in Microsoft Office Excel's file parsing engine allows remote information disclosure when a user opens a crafted spreadsheet file. Affected versions span Office 2016 through Office 2024 LTSC and Microsoft 365 Apps for Enterprise across Windows and Mac platforms, with fixed builds confirmed for Windows variants per EUVD-2026-73733. No public exploit code has been identified at time of analysis, and SSVC rates current exploitation as none with partial technical impact, consistent with the absence of a CISA KEV listing.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Untrusted pointer dereference in Microsoft Office PowerPoint exposes high-confidentiality memory contents to a remote, unauthenticated attacker who can convince a user to open a specially crafted presentation file. The flaw (CWE-822) allows the application to dereference a pointer sourced from untrusted file data without validation, enabling out-of-bounds or arbitrary memory reads that leak sensitive process memory over a network context. No public exploit code or CISA KEV listing is present at time of analysis, but the high-confidentiality CVSS rating and broad install base across all current Office versions make patch deployment a priority.
Privilege escalation via relative path traversal (CWE-23) affects the Windows DNS Server service across a broad range of Windows Server releases from 2012 through 2025. An authorized local attacker holding high-privilege access can manipulate relative path sequences in the DNS service to reference files or system resources outside the intended directory scope, resulting in full Confidentiality, Integrity, and Availability impact through SYSTEM-level privilege escalation. Microsoft has released patches across all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Type confusion (CWE-822) in Microsoft Office PowerPoint allows a remote unauthenticated attacker to disclose sensitive information from a victim's system by inducing them to open a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and Mac variants of Office across multiple release channels. Vendor-released patches are available for Windows editions with specific fixed build numbers; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in the Windows Winsock networking subsystem enables local privilege escalation to SYSTEM-level on a broad range of Windows client and server releases. An attacker who already holds a high-privileged (but non-SYSTEM) local account can trigger CWE-122 heap corruption through Winsock to achieve full C:H/I:H/A:H impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.