Microsoft
Monthly
Security feature bypass in Visual Studio Code before 1.136.2 allows a local attacker to circumvent an input-validation blocklist (CWE-184), resulting in high confidentiality, integrity, and availability impact. The vulnerability requires user interaction - most plausibly opening a crafted workspace or file - but no elevated privileges. Microsoft shipped a vendor patch capping affected versions below 1.136.2; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Remote code execution via use-after-free in Windows DNS Server affects Windows Server 2022 and 2025, allowing an unauthenticated network attacker to execute arbitrary code on the DNS service host. The vulnerability resides in the DNS service's heap memory management, where a freed object is subsequently dereferenced, enabling memory corruption with full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. Microsoft has released patches for all confirmed affected builds; no public exploit has been identified at time of analysis.
Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Privilege escalation via use-after-free in the Win32K kernel subsystem affects multiple Windows 11 and Windows Server 2025 builds, allowing a locally authenticated low-privileged attacker to achieve full SYSTEM-level access. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including its Server Core variant. No public exploit has been identified at time of analysis, though the high C:H/I:H/A:H impact combined with the kernel attack surface makes this a meaningful post-exploitation and lateral-movement primitive in multi-user or RDP-exposed environments.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Accounts Control exploits a use-after-free (CWE-416) condition, allowing an authorized but low-privileged local attacker to gain full system-level privileges across a wide range of Windows desktop and server versions. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires local authenticated access and high attack complexity, consistent with UAF race-condition exploitation. Microsoft has released patches covering Windows 10, Windows 11, and Windows Server 2016 through 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Privilege escalation in Microsoft .NET's diagnostic runtime allows a network-reachable unauthenticated attacker - contingent on user interaction - to gain elevated privileges by supplying an externally controlled file path (CWE-73). The vulnerable component is Microsoft.Diagnostics.Runtime, embedded in Visual Studio 2026 (18.9.x) and Visual Studio 2022 (17.14.x), making developer workstations the primary target. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H and UI:R requirements meaningfully reduce practical exploitability despite the full C:H/I:H/A:H impact rating.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Remote code execution via use-after-free in Microsoft Office PowerPoint enables a network-positioned, unauthenticated attacker to execute arbitrary code on a victim's system when the victim opens a crafted PowerPoint file. The flaw spans the entire current Office product family including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, PowerPoint 2016, Office 2019, and their Mac counterparts. No public exploit code or active CISA KEV listing has been identified at time of analysis, but the broad product coverage and lack of privilege requirements make this a high-priority patch target.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables network-delivered remote code execution across six Microsoft Office product lines. When a victim opens a maliciously crafted Access database file delivered over a network, the overflow corrupts heap memory and allows an attacker to execute arbitrary code with the privileges of the logged-in user. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution across all currently-supported Office editions when a victim opens a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through 2024 LTSC on both x86 and x64 platforms, the vulnerability requires no attacker privileges but depends on user interaction - the classic malicious-document delivery model. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating, full confidentiality/integrity/availability impact, and the near-universal enterprise footprint of Microsoft Office make this a high-priority patching candidate.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Local privilege escalation in the Windows Broadcast DVR User Service allows a low-privileged authenticated attacker to gain full system control via a use-after-free memory corruption bug. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds, with Microsoft releasing patches across all affected branches. No public exploit code or active exploitation has been identified at time of analysis, but local LPE vulnerabilities of this class are routinely incorporated into post-exploitation toolchains following initial access.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Security feature bypass in Visual Studio Code before 1.136.2 allows a local attacker to circumvent an input-validation blocklist (CWE-184), resulting in high confidentiality, integrity, and availability impact. The vulnerability requires user interaction - most plausibly opening a crafted workspace or file - but no elevated privileges. Microsoft shipped a vendor patch capping affected versions below 1.136.2; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. Microsoft self-reported the flaw and has shipped fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Win32 Kernel Subsystem enables local privilege escalation to SYSTEM across a wide range of Microsoft Windows client and server editions. An authenticated low-privilege local user can trigger the overflow with low attack complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) on the affected host. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but this kernel-level LPE class is historically high-value for post-exploitation chaining.
Local privilege escalation in Windows Win32K allows an authenticated low-privileged user to gain SYSTEM-level access across virtually all supported and legacy Windows versions. The flaw stems from incorrect authorization checks (CWE-863) in the Win32K kernel-mode subsystem, enabling a local attacker to bypass privilege boundaries with no user interaction required. No public exploit has been identified and CISA's SSVC assessment rates exploitation status as none, though technical impact is rated total - patch deployment is nonetheless warranted given the ubiquity of the affected platform and the historical weaponization of Win32K LPE bugs in targeted intrusion chains.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server component allows unauthenticated network attackers to disclose potentially sensitive server memory contents by sending a specially crafted DHCP packet. The flaw spans a broad range of Windows releases from Server 2012 through Server 2025 and certain Windows 10 builds, with Microsoft-confirmed patches available and exact fix build numbers documented by ENISA EUVD-2026-73249. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS at 0.77% (53rd percentile) reflects low current exploitation probability despite the trivially low attack complexity.
Unauthenticated remote denial-of-service in Windows DHCP Server (CWE-401) allows a network attacker to exhaust server memory without credentials, crashing or degrading the DHCP service across a broad range of Microsoft server OS versions from Server 2012 through Server 2025. Confirmed by Microsoft (secure@microsoft.com) and published via ENISA EUVD-2026-73338, the zero-complexity CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) means exploitation requires only the ability to reach UDP/67 on the target. No public exploit code and no CISA KEV listing were identified at time of analysis.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service exposes server memory contents to unauthenticated remote attackers via crafted DHCP packets. Confirmed via EUVD/MSRC data, the flaw spans Windows Server 2012 through 2025 across both full and Server Core installations, as well as select Windows 10 versions running the DHCP Server role. Microsoft has released patched builds; no public exploit code or CISA KEV listing exists at time of analysis, keeping near-term exploitation risk moderate.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service exposes server memory to unauthenticated remote attackers across Windows Server 2012 through 2025 and select Windows 10 builds. A crafted DHCP request packet triggers a read beyond the allocated buffer in the server's packet-processing code, leaking potentially sensitive memory contents with no integrity or availability impact. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS of 0.77% (53rd percentile) reflects below-median exploitation probability despite the zero-authentication network vector.
Heap-based buffer overflow in the Windows Print Spooler service allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-122) is exploitable locally with standard user credentials and no user interaction, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Print Spooler has a long history of high-profile exploitation, including PrintNightmare, making this class of bug a priority for patching.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Remote code execution in Microsoft Windows Hyper-V arises from a stack-based buffer overflow that lets an unauthorized attacker run arbitrary code across a network, per Microsoft's CVSS 3.1 vector (AV:N/PR:N/UI:N) scoring 9.8. The flaw affects the Hyper-V virtualization component across a broad range of client and server Windows builds, from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025. Microsoft has released fixes; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Windows Enterprise App Management allows a low-privileged authenticated local attacker to gain full control over an affected system via improper handling of insufficient permissions (CWE-280). The vulnerability spans a wide swath of Microsoft's Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making it broadly relevant to enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Secure Kernel Mode enables an authorized local attacker with administrative privileges to escalate into the secure kernel isolation boundary, achieving full confidentiality, integrity, and availability impact (S:C, C:H/I:H/A:H). The vulnerability spans a broad range of Windows platforms - from Server 2016 and Windows 10 1607 through Windows 11 26H1 and Server 2025 - and was reported by Microsoft's own security engineering team. No public exploit code or active exploitation has been identified; Microsoft has released patches across all affected build lines.
Privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver exposes multiple Windows 10, Windows 11, and Windows Server 2025 builds to local SYSTEM-level compromise through CWE-822 untrusted pointer dereference. A low-privileged local attacker can craft an IOCTL that causes the driver to dereference an attacker-controlled pointer value in kernel context, yielding full system takeover. Microsoft has released patched builds across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation in Windows Media on all supported Microsoft Windows desktop and server releases allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory condition (CWE-416). The CVSS AC:H metric indicates exploitation is non-trivial, consistent with a race condition or complex heap-manipulation sequence required to reliably control freed memory. A vendor patch is available across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows Virtual Trusted Platform Module enables a locally authenticated, high-privileged attacker to escalate privileges across a security boundary on affected Windows 10, 11, and Server editions. The CVSS scope-change metric (S:C) confirms exploitation breaks out of the vTPM trust boundary, yielding complete confidentiality, integrity, and availability impact on the broader host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as 'none' and automatable as 'no.'
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Null pointer dereference in the Windows Internet Key Exchange (IKE) Extension enables remote unauthenticated attackers to crash the IKE service, causing denial of service on affected systems. The flaw spans twelve distinct Windows releases from Windows 10 21H2 through Windows 11 26H1 and Windows Server 2019 through Server 2025, and is reachable over the network with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack path makes this a straightforward DoS primitive against any exposed IPsec endpoint.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free memory corruption in the Windows Hello authentication subsystem allows a local, low-privileged authenticated user to escalate privileges to a higher-integrity context across a security boundary. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, with specific patched build numbers published by Microsoft. No public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C, C:H/I:H/A:H) signals that successful exploitation yields full compromise of a more privileged security principal.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is possible through a time-of-check time-of-use (TOCTOU) race condition. An authenticated local attacker with low privileges can win the race window to escalate to higher privilege levels, achieving full confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, but the breadth of affected Windows versions — spanning Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025 — gives this vulnerability a large attack surface.
Remote code execution via use-after-free in Windows DNS Server affects Windows Server 2022 and 2025, allowing an unauthenticated network attacker to execute arbitrary code on the DNS service host. The vulnerability resides in the DNS service's heap memory management, where a freed object is subsequently dereferenced, enabling memory corruption with full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. Microsoft has released patches for all confirmed affected builds; no public exploit has been identified at time of analysis.
Privilege elevation in Spring Cloud Azure (versions 1.0.0 up to but not including 7.4.0) lets a network-based, unauthenticated attacker bypass improper authentication logic (CWE-287) to gain elevated privileges. Reported by Microsoft (MSRC) with a vendor patch available; no public exploit identified at time of analysis and neither KEV nor EPSS/POC signals are present in the provided data.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows a network-reachable low-privileged attacker to execute arbitrary code on affected Windows systems, achieving full confidentiality, integrity, and availability compromise. The vulnerability spans an exceptionally broad range of Microsoft Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, as confirmed by EUVD-2026-73631. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, though Microsoft has released corrective security updates across all affected platforms.
Heap-based buffer overflow in the Windows DHCP Server service allows an authenticated attacker with adjacent network access to achieve remote code execution on the target system. The vulnerability (CWE-122) exists across a wide range of Windows Server and Windows client versions, from Server 2012 through Server 2025 and Windows 10/11 builds, all fixed in the July 2026 Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS 8.0 score and full C/I/A:H impact make this a high-priority patching target for any organization running Windows DHCP Server infrastructure.
Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to trigger a heap-based buffer overflow and execute arbitrary code, per CVSS with full confidentiality, integrity, and availability impact (9.8). All supported Windows Server builds from 2012 through 2025 running the DHCP Server role are affected. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the network-facing unauthenticated RCE profile makes this a high-priority patch item for domain infrastructure.
Local privilege escalation in Windows Win32K - the kernel-mode graphics and windowing subsystem - allows a low-privileged local user to gain SYSTEM-level access via an out-of-bounds read (CWE-125). The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically high-value targets for post-exploitation privilege escalation chains.
Heap-based buffer overflow in the Windows Encrypting File System (EFS) component enables a locally authenticated attacker to escalate privileges to SYSTEM level. The vulnerability spans virtually the entire modern Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Privilege escalation via use-after-free in Windows Print Spooler Components (spoolsv.exe) allows a locally authenticated low-privileged user to gain SYSTEM-level access across a broad range of Windows client and server versions from Server 2012 R2 through Windows 11 25H2. Exploitation requires high attack complexity, suggesting a race condition or precise heap manipulation, but success yields full system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; vendor-released patches are available via Windows Update.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Remote code execution in the Microsoft Windows Shell component stems from a heap-based buffer overflow (CWE-122) that lets an unauthorized attacker run arbitrary code over a network, per the CVSS vector at full C/I/A impact. The flaw spans essentially the entire supported Windows line - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 - and Microsoft has shipped patches. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Remote code execution in the Microsoft Standard XPS document component affects a broad range of Windows and Windows Server releases (Windows 10, Windows 11 through 25H2/26H1, and Server 2012 through Server 2025). An integer underflow during XPS data handling can be triggered by an unauthorized attacker to corrupt the heap and execute arbitrary code, per Microsoft's CVSS 9.8 rating. A vendor patch is available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos authentication subsystem, triggered by a numeric truncation error, enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on all major supported Windows releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates low attack complexity and no user interaction required once local code execution is achieved, yielding full confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Remote code execution in the Microsoft Windows RPC Runtime (rpcrt4) allows an unauthorized network attacker to trigger an out-of-bounds write and execute arbitrary code, per CVSS with no authentication or user interaction. All supported Windows client and server releases from Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. No public exploit identified at time of analysis, but the network-facing, unauthenticated RPC attack surface gives this significant wormable potential.
Privilege escalation via use-after-free in the Win32K kernel subsystem affects multiple Windows 11 and Windows Server 2025 builds, allowing a locally authenticated low-privileged attacker to achieve full SYSTEM-level access. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including its Server Core variant. No public exploit has been identified at time of analysis, though the high C:H/I:H/A:H impact combined with the kernel attack surface makes this a meaningful post-exploitation and lateral-movement primitive in multi-user or RDP-exposed environments.
Use-after-free in the Windows Bluetooth Port Driver enables a local low-privileged attacker to escalate privileges, potentially reaching SYSTEM-level access across a broad range of Windows 10, Windows 11, and Windows Server versions. The vulnerability (CWE-416) requires high attack complexity, consistent with timing-dependent memory corruption exploitation typical of UAF flaws in kernel-mode drivers. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Accounts Control exploits a use-after-free (CWE-416) condition, allowing an authorized but low-privileged local attacker to gain full system-level privileges across a wide range of Windows desktop and server versions. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires local authenticated access and high attack complexity, consistent with UAF race-condition exploitation. Microsoft has released patches covering Windows 10, Windows 11, and Windows Server 2016 through 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Path traversal in Windows PowerShell enables a low-privileged, network-authenticated attacker to escalate privileges to higher access levels across a broad range of Windows desktop and server versions. The flaw (CWE-22) allows improper resolution of file paths outside a restricted directory boundary within the PowerShell subsystem, reachable over the network with user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches addressing all affected builds.
Privilege escalation in Microsoft .NET's diagnostic runtime allows a network-reachable unauthenticated attacker - contingent on user interaction - to gain elevated privileges by supplying an externally controlled file path (CWE-73). The vulnerable component is Microsoft.Diagnostics.Runtime, embedded in Visual Studio 2026 (18.9.x) and Visual Studio 2022 (17.14.x), making developer workstations the primary target. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H and UI:R requirements meaningfully reduce practical exploitability despite the full C:H/I:H/A:H impact rating.
Remote code execution in Microsoft SharePoint Server Subscription Edition is possible via a time-of-check time-of-use (TOCTOU) race condition exploitable by authenticated network attackers. The vulnerability, tracked as CWE-367, allows an attacker with at minimum standard SharePoint user credentials to trigger a race window during a file or resource state check, ultimately executing arbitrary code on the server. The CVSS vector (AV:N/AC:H/PR:L) reflects that exploitation requires winning a timing race, raising the bar above trivially automated attacks, but the full C:H/I:H/A:H impact means successful exploitation yields complete server compromise. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds memory read in the Windows DHCP Server service exposes potentially sensitive server memory to unauthenticated remote attackers who send specially crafted DHCP packets. The flaw (CWE-125) spans Microsoft Windows Server 2012 through 2025 and select Windows 10 builds where the DHCP Server role is installed, with Microsoft assigning CVSS 7.5 reflecting full network accessibility and zero authentication requirement. No active exploitation or public proof-of-concept has been identified; EPSS sits at 0.77% (53rd percentile) and a vendor-supplied patch is available.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Remote code execution via use-after-free in Microsoft Office PowerPoint enables a network-positioned, unauthenticated attacker to execute arbitrary code on a victim's system when the victim opens a crafted PowerPoint file. The flaw spans the entire current Office product family including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, PowerPoint 2016, Office 2019, and their Mac counterparts. No public exploit code or active CISA KEV listing has been identified at time of analysis, but the broad product coverage and lack of privilege requirements make this a high-priority patch target.
Security feature bypass in the Windows TCP/IP stack allows unauthenticated remote attackers to circumvent network-level security controls across a broad range of Windows client and server versions, from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025. Exploitation leverages CWE-1288 (improper consistency validation within input), meaning crafted packets with internally contradictory fields can slip past enforcement mechanisms - resulting in high integrity impact with no confidentiality or availability effect. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version families.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Heap-based buffer overflow in Windows Credential Providers enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges across a broad range of Windows 10, 11, and Windows Server releases. The CWE-122 flaw resides in the credential provider subsystem, requiring no user interaction and no elevated starting privileges, making it a reliable post-compromise escalation primitive for multi-stage attacks. No public exploit code or active exploitation has been confirmed at time of analysis; a vendor patch from Microsoft is available covering all affected branches.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of unpatched Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker can trigger the overflow via a crafted biometric request, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Win32K allows a low-privileged authenticated attacker to achieve full SYSTEM-level code execution via a time-of-check time-of-use (TOCTOU) race condition in the kernel graphics subsystem. The vulnerability spans an exceptionally broad range of Microsoft Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all current servicing branches - making patch deployment a significant operational undertaking. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K LPE flaws are historically favored as second-stage payloads in multi-stage attack chains following initial remote compromise.
Heap-based buffer overflow (CWE-122) in Microsoft Office Access enables network-delivered remote code execution across six Microsoft Office product lines. When a victim opens a maliciously crafted Access database file delivered over a network, the overflow corrupts heap memory and allows an attacker to execute arbitrary code with the privileges of the logged-in user. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Windows DHCP Client enables an authenticated attacker on the same network segment to escalate privileges on Windows 11 systems. The vulnerability (CWE-122) affects Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds, with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code and no active exploitation have been identified at the time of analysis; Microsoft has released a patch via the June/July 2026 Patch Tuesday cycle.
Privilege escalation via use-after-free in Windows Desktop Window Manager (DWM) Core Library affects Windows Server 2025 and Windows 11 23H2, allowing an authenticated attacker with low privileges to gain elevated system access over a network. The vulnerability stems from improper memory management (CWE-416) in the DWM graphics subsystem, and successful exploitation delivers high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and Microsoft has released patches via the MSRC update guide.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows HTTP Print Provider allows an unauthenticated network attacker to execute arbitrary code by exploiting a heap-based buffer overflow (CWE-122). The flaw affects a broad range of Windows client and server releases from Server 2012 through Windows 11 25H2 and Server 2025, and per the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector requires no authentication or user interaction. No public exploit identified at time of analysis, but the network-reachable, pre-auth nature and 9.8 severity make it a high-priority patch.
Remote code execution in the Windows RNDIS (Remote Network Driver Interface Specification) component affects the full supported Windows line, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An unauthorized attacker can trigger a heap-based buffer overflow (CWE-122) by delivering malformed RNDIS control/data messages, achieving arbitrary code execution with high confidentiality, integrity, and availability impact. Microsoft has published a patch across all affected builds; there is no public exploit identified at time of analysis and no KEV/EPSS data supplied.
Use-after-free in Microsoft Office PowerPoint enables remote code execution when a victim opens a specially crafted PowerPoint document. The vulnerability affects PowerPoint 2016, 2019, Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac across multiple build versions, spanning virtually the entire active Office install base. Vendor patches have been released; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution across all currently-supported Office editions when a victim opens a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through 2024 LTSC on both x86 and x64 platforms, the vulnerability requires no attacker privileges but depends on user interaction - the classic malicious-document delivery model. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating, full confidentiality/integrity/availability impact, and the near-universal enterprise footprint of Microsoft Office make this a high-priority patching candidate.
Stack-based buffer overflow in the Windows Win32K kernel-mode driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM level via a network-accessible exploit path, affecting 12 distinct Windows releases spanning Windows 10 1809 through Windows Server 2025 and Windows 11 26H1. The CWE-121 flaw resides in the kernel subsystem handling GDI rendering and windowing, making successful exploitation equivalent to full operating system compromise. Microsoft has released patches addressing all affected build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free (CWE-416) in the Windows TCP/IP networking stack enables an authenticated, low-privileged attacker to escalate privileges to a higher trust level via a network-based attack path. The vulnerability affects a broad surface - Windows 10 through Windows 11 and Windows Server 2012 through 2025 - making the potential impact wide despite the elevated attack complexity (AC:H) and required user interaction (UI:R) constraints in the CVSS vector. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read (CWE-125) in the Windows Kerberos implementation enables unauthenticated remote denial of service across a broad swath of Microsoft Windows versions. An attacker who can send a crafted Kerberos request over the network can crash the Kerberos service, disrupting authentication for all domain-joined users and services on the affected host. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in the Windows TCP/IP driver allows a network-adjacent low-privileged authenticated attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server 2019-2025 installations. The CVSS:3.1 vector (AV:N/AC:H/PR:L/UI:R) indicates exploitation requires high attack complexity and user interaction, consistent with a race-condition-triggered UAF in the kernel networking stack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the broad affected product surface and the Microsoft-origin report make this a priority for enterprise patch cycles.
Remote unauthenticated denial of service in Windows Kerberos allows a network attacker to crash the Kerberos authentication service on affected Windows Server 2025 and Windows 11 (24H2/25H2) systems. A CWE-476 null pointer dereference is triggered by a specially crafted Kerberos packet, causing the service to terminate and disrupting all Kerberos-based authentication on the affected host. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Remote code execution is possible in Microsoft Office Publisher across multiple Office suite versions when a victim opens a maliciously crafted Publisher document. The root cause is an integer overflow or wraparound (CWE-190) in the file-parsing subsystem, which typically produces an understated buffer allocation that an attacker can exploit to corrupt heap memory and redirect execution. Affected releases span Publisher 2016 through Microsoft 365 Apps for Enterprise; vendor-released patches are available for all affected versions, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Out-of-bounds read in Microsoft Office (2016 through 365 Apps for Enterprise and LTSC 2024) enables an unauthenticated remote attacker to disclose sensitive memory contents over a network, per the provided CVSS vector. Affected products span both perpetual-license and subscription editions across x64 and x86 architectures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and Microsoft has released patches across all affected version lines.
Local privilege escalation in Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain SYSTEM-level control via a heap-based buffer overflow triggered by an integer overflow or wraparound. The flaw affects a wide sweep of Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface nearly universal across modern Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, but vendor patch is available and should be prioritized given the full C:H/I:H/A:H impact after a successful escalation.
Local privilege escalation in the Windows Broadcast DVR User Service allows a low-privileged authenticated attacker to gain full system control via a use-after-free memory corruption bug. The vulnerability affects a wide swath of Windows 10, Windows 11, and Windows Server 2016/2019 builds, with Microsoft releasing patches across all affected branches. No public exploit code or active exploitation has been identified at time of analysis, but local LPE vulnerabilities of this class are routinely incorporated into post-exploitation toolchains following initial access.
Heap-based buffer overflow in the Windows Link Layer Topology Discovery Protocol (LLTD) implementation enables unauthenticated attackers to execute arbitrary code on affected Windows systems via crafted network-layer frames. The flaw (CWE-122) spans nearly the entire supported Windows ecosystem - from Windows 10 through Windows 11 and from Windows Server 2012 through Server 2025. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft Windows DNS Server role (across Windows Server 2012 through 2025 and Windows 10 1607/1809) stems from a use-after-free that an unauthenticated attacker can trigger over the network, per CVSS PR:N/UI:N. Microsoft rates it 9.8 (critical) with full confidentiality, integrity, and availability impact, and a vendor patch is available. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.