Microsoft
Monthly
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via a double-free memory corruption bug in Windows Failover Cluster affects multiple Windows Server editions from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. An authorized local attacker already holding high privileges can exploit heap corruption triggered by the double-free condition to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Word exposes sensitive process memory to a remote unauthenticated attacker who can deliver a maliciously crafted Word document and trick a user into opening it. The flaw affects a broad range of Microsoft Office products - Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, and Word 2016 - across both Windows (x86/x64) and macOS platforms. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-supplied patches have been released addressing specific build versions across all affected product lines.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
SQL injection in Microsoft SharePoint Server Subscription Edition allows any network-authenticated low-privilege user to exfiltrate sensitive database contents without additional interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that a standard SharePoint account is the only prerequisite, placing sensitive intranet data - documents, user records, site configuration - at risk. Microsoft has released a remediation build (16.0.20326.20082); no public exploits or CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Buffer over-read (CWE-126) in Microsoft Office exposes process memory contents to remote unauthenticated attackers when a victim opens a maliciously crafted Office document. The vulnerability spans a wide range of Office product lines across both Windows and macOS - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and the macOS Office 365/LTSC equivalents. No public exploit code has been identified and the CVE does not appear in the CISA KEV catalog at time of analysis; a vendor patch has been released across all affected product lines.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Information disclosure in Microsoft SharePoint Server Subscription Edition allows a low-privileged authenticated attacker to read sensitive data over the network by leveraging a SharePoint component that executes with unnecessary elevated privileges (CWE-250). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) reflects a straightforward network-accessible exploit requiring only basic user credentials, with no user interaction and high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via a double-free memory corruption bug in Windows Failover Cluster affects multiple Windows Server editions from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. An authorized local attacker already holding high privileges can exploit heap corruption triggered by the double-free condition to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Null pointer dereference in Windows Schannel - Microsoft's native TLS/SSL security package - allows an authenticated network attacker to crash the affected service on Windows Server 2022, Windows Server 2025, and Windows 11 versions 23H2 through 26H1. The CVSS vector (AV:N/AC:H/PR:L) places this as a moderate-severity denial-of-service requiring valid credentials and non-trivial triggering conditions, with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Server-side request forgery (SSRF) in Microsoft SharePoint Server Subscription Edition enables a low-privileged authenticated attacker to cause the server to issue outbound network requests, resulting in limited information disclosure. Exploitation requires user interaction in addition to a valid low-level account, constraining real-world impact to authenticated insider or phishing-assisted scenarios. No public exploit code has been identified, and the vulnerability carries a low CVSS base score of 3.5, reflecting its narrow confidentiality-only impact.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Symlink-following in Windows Container Manager Service allows a local low-privileged authenticated user to bypass a security feature and read files outside the intended access boundary. Affected are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across specific build ranges, per EUVD. Impact is limited to confidentiality (C:H), with no integrity or availability consequence. No public exploit code and no CISA KEV listing are present at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Word exposes sensitive process memory to a remote unauthenticated attacker who can deliver a maliciously crafted Word document and trick a user into opening it. The flaw affects a broad range of Microsoft Office products - Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, and Word 2016 - across both Windows (x86/x64) and macOS platforms. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-supplied patches have been released addressing specific build versions across all affected product lines.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker with low-level privileges to inject malicious scripts into pages rendered by SharePoint, enabling spoofing attacks against other authenticated users. The flaw is classified CWE-79 and confirmed by Microsoft (secure@microsoft.com) with a vendor patch available targeting builds below 16.0.20326.20090. No public exploit code has been identified and the vulnerability does not appear in CISA KEV.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Local information disclosure in the Windows DNS component affects multiple Microsoft Windows Server versions from 2012 through 2025. An authorized local attacker with low privileges can trigger an uninitialized resource condition (CWE-908) in the DNS service, potentially reading stale memory contents that may include DNS query data, internal server state, or other sensitive in-process information. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected version branches.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
SQL injection in Microsoft SharePoint Server Subscription Edition allows any network-authenticated low-privilege user to exfiltrate sensitive database contents without additional interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that a standard SharePoint account is the only prerequisite, placing sensitive intranet data - documents, user records, site configuration - at risk. Microsoft has released a remediation build (16.0.20326.20082); no public exploits or CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Buffer over-read (CWE-126) in Microsoft Office exposes process memory contents to remote unauthenticated attackers when a victim opens a maliciously crafted Office document. The vulnerability spans a wide range of Office product lines across both Windows and macOS - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and the macOS Office 365/LTSC equivalents. No public exploit code has been identified and the CVE does not appear in the CISA KEV catalog at time of analysis; a vendor patch has been released across all affected product lines.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition enables an authorized high-privilege attacker to inject malicious script into SharePoint pages, causing spoofing attacks against other users who view the injected content. The CVSS base score of 3.5 reflects the high authentication bar (PR:H) and mandatory victim interaction (UI:R), confining realistic exploitation to insider-threat scenarios or compromised privileged accounts rather than external unauthenticated attackers. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2017 and 2019 exposes sensitive memory contents to remote unauthenticated attackers over the network. The flaw (CWE-125) exists in a network-accessible SQL Server component and is reachable without authentication, though user interaction is required (CVSS UI:R). Microsoft has released patched builds for all affected servicing branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Tampering via NTFS link-following in Windows 11 allows a local low-privileged attacker to overwrite or modify files they would not ordinarily have write access to. The vulnerability (CWE-59) is triggered when a privileged Windows component resolves a symlink or junction point created by the attacker, resulting in file access against an unintended target. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected Windows 11 versions.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition (builds prior to 16.0.20326.20090) allows an authenticated low-privileged attacker to inject malicious scripts into SharePoint pages, enabling spoofing attacks against users who view the compromised content. The CVSS vector (PR:L/UI:R/C:H/I:H) indicates victim interaction is required and that impact may extend to session token exposure or impersonation within the SharePoint context. No public exploit code has been confirmed and no active exploitation is listed in CISA KEV at time of analysis.
Buffer over-read (CWE-126) in the Windows DHCP Server service allows a low-privileged, adjacent-network attacker to crash the DHCP Server process, resulting in denial of service for all clients depending on that server. Affected platforms span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809 running the DHCP Server role, all at builds below the vendor-specified patched versions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the adjacent-network and low-privilege constraints substantially bound real-world exposure.
Privilege escalation in Windows DHCP Server allows an already-authorized (high-privilege) network attacker to gain further elevated privileges by exploiting a missing authentication check on a critical server function (CWE-306). The vulnerability spans nearly every supported Windows Server release from 2012 through 2025, as well as Windows 10 1607/1809. No public exploit code has been identified at time of analysis, and Microsoft has issued patches across all affected builds.
Information disclosure in Microsoft SharePoint Server Subscription Edition allows a low-privileged authenticated attacker to read sensitive data over the network by leveraging a SharePoint component that executes with unnecessary elevated privileges (CWE-250). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) reflects a straightforward network-accessible exploit requiring only basic user credentials, with no user interaction and high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Memory exhaustion in Windows DHCP Server enables an authorized attacker on the adjacent network to crash or degrade the DHCP service via repeated triggering of a CWE-401 memory leak. The vulnerability affects the Windows Server DHCP Server role across Windows Server 2012 through 2025, including Server Core installations. Exploitation requires low-privilege adjacency and results exclusively in availability loss - no confidentiality or integrity impact. No public exploit identified at time of analysis; vendor patch is available.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server Subscription Edition allows an authenticated network attacker to inject malicious script into page output, enabling spoofing attacks against other users. Successful exploitation requires the victim to interact with attacker-controlled content but can result in high confidentiality and integrity impact within the victim's SharePoint session context. Microsoft has released patch version 16.0.20326.20090 addressing this flaw, reported internally via secure@microsoft.com.
Format string exploitation in Microsoft Active Directory Certificate Services (AD CS) allows a low-privileged authenticated attacker to disclose sensitive information over the network. The flaw (CWE-134) arises from externally-controlled format string input reaching a format function without sanitization, potentially exposing memory contents including PKI-sensitive data. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows DNS component exposes memory contents to locally authenticated attackers across a wide range of Windows Server and Windows 10 versions. The flaw (CWE-125) allows a low-privileged local attacker to read memory beyond the intended buffer boundary, resulting in high-confidence information disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the local-only attack vector and medium CVSS score of 5.5.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.