Microsoft
Monthly
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Use-after-free in Windows Embedded Mode Service allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access across virtually all supported Windows versions. The memory corruption occurs when the service accesses a previously freed object, enabling an attacker to manipulate heap layout and execute code in a privileged context. No public exploit or active exploitation (KEV) has been identified; Microsoft has released patches via Windows Update, and the AC:H rating reflects the timing-dependent race-condition exploitation typical of UAF primitives.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Use-after-free in Windows Shell enables local privilege escalation on Windows 11 and Windows Server 2025, allowing a low-privileged authenticated user to elevate to SYSTEM or equivalent. The CVSS scope change (S:C) indicates the impact extends beyond the exploited shell component to the broader OS. No public exploit code or CISA KEV listing has been identified at this time, but the scope change and high C/I/A triad make patching urgent for environments running affected Windows builds.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Shell allows a locally authenticated attacker with standard user rights to gain full system-level control via external control of a file name or path (CWE-73). Affected platforms span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, all prior to their respective July 2026 patch-cycle builds. Microsoft has released patches via Windows Update; no public exploit code or CISA KEV listing exists at time of analysis, though the C:H/I:H/A:H impact profile makes this a priority for environments where post-initial-access escalation is a concern.
Privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) stems from missing authorization checks (CWE-862) on one or more network-accessible operations, enabling authenticated low-privileged users to gain high-impact read and write access beyond their assigned roles. All major in-support Exchange branches are affected across specific build ranges. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score reflects substantial post-exploitation impact.
Local privilege escalation in Windows NTFS allows a low-privileged attacker to gain full system control by abusing improper symbolic or hard link resolution during file access. Affects Windows 11 versions 23H2 through 26H1 and Windows Server 2025, with patches tied to specific build thresholds confirmed via EUVD data. No public exploit identified at time of analysis; CVSS AC:H reflects a race condition or precise sequencing requirement characteristic of link-following primitives, moderating immediate urgency.
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. Patch is available from Microsoft; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated, low-privileged attacker to gain full system-level control without additional user interaction. The root cause is CWE-862 (Missing Authorization): the MDM component fails to enforce authorization checks on operations that should require elevated privileges, enabling an attacker who already has local access to escalate to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, but the low complexity and broad Windows footprint make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server allows a low-privileged authenticated network attacker to execute arbitrary code by supplying externally controlled file paths (CWE-73). Affected are Exchange Server 2016 CU23, 2019 CU14/CU15, and the Subscription Edition RTM release lines, all prior to their respective July 2026 patch levels. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft's history with Exchange RCE vulnerabilities makes this a high-priority remediation target for any organization running on-premises Exchange.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Microsoft Windows Search Component exposes Windows 11 and Windows Server 2022/2025 systems to full system compromise via a double-free memory corruption flaw. An authenticated, low-privileged attacker can trigger the vulnerability over the network with user interaction to gain SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, though a vendor patch is available.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Remote Desktop Gateway Service allows a low-privileged authorized attacker to achieve full system compromise via a double-free memory corruption flaw (CWE-415). Affected systems span Windows Server 2012 through 2025 and select Windows 10 builds where the RD Gateway role is installed. Microsoft has released patches across all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Microsoft Office enables remote unauthenticated attackers to achieve arbitrary code execution by convincing a target user to open a specially crafted Office document delivered over a network. All major Office perpetual and subscription releases are affected, spanning versions from Office 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024. Vendor-released patches are available via Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact, low-complexity CVSS profile warrants prioritized patching in enterprise environments.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Use-after-free in Windows Embedded Mode Service allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access across virtually all supported Windows versions. The memory corruption occurs when the service accesses a previously freed object, enabling an attacker to manipulate heap layout and execute code in a privileged context. No public exploit or active exploitation (KEV) has been identified; Microsoft has released patches via Windows Update, and the AC:H rating reflects the timing-dependent race-condition exploitation typical of UAF primitives.
Heap-based buffer overflow in the Windows IKE (Internet Key Exchange) Extension allows an authorized network-adjacent attacker to achieve remote code execution across a wide range of Windows client and server releases. The vulnerability (CWE-122) resides in the IKE/IPsec negotiation subsystem and requires low-privilege access to trigger, placing the full C:H/I:H/A:H impact triad within reach of authenticated network peers. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected builds.
Remote denial of service in Windows LDAP affects all major Windows desktop and server releases from Windows 10 1607 through Windows Server 2025, allowing unauthenticated network attackers to crash the LDAP service by sending a malformed packet that triggers an out-of-bounds read (CWE-125). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, credential-free exploitation with high availability impact and no confidentiality or integrity loss. Microsoft has released patches; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver (Windows 11 24H2/25H2/26H1 and Windows Server 2025) is enabled by a use-after-free memory corruption flaw in a kernel-mode driver component. A local attacker holding a standard user account can exploit the UAF condition to achieve ring-0 code execution, yielding complete confidentiality, integrity, and availability compromise of the affected system. Microsoft has released patches; no public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows a locally authenticated attacker to escalate privileges to SYSTEM on affected Windows 10 and Windows Server 2012 through 2019 systems. Microsoft has released patches via MSRC addressing builds across all listed version ranges, including Server 2012, 2012 R2, 2016, 2019, and Windows 10 1607 and 1809. No public exploit code or CISA KEV listing has been identified at time of analysis; the AC:H metric indicates exploitation requires precise heap manipulation or race condition timing.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Use-after-free in Windows Shell enables local privilege escalation on Windows 11 and Windows Server 2025, allowing a low-privileged authenticated user to elevate to SYSTEM or equivalent. The CVSS scope change (S:C) indicates the impact extends beyond the exploited shell component to the broader OS. No public exploit code or CISA KEV listing has been identified at this time, but the scope change and high C/I/A triad make patching urgent for environments running affected Windows builds.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Shell allows a locally authenticated attacker with standard user rights to gain full system-level control via external control of a file name or path (CWE-73). Affected platforms span Windows 11 versions 23H2 through 26H1 and Windows Server 2025, all prior to their respective July 2026 patch-cycle builds. Microsoft has released patches via Windows Update; no public exploit code or CISA KEV listing exists at time of analysis, though the C:H/I:H/A:H impact profile makes this a priority for environments where post-initial-access escalation is a concern.
Privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) stems from missing authorization checks (CWE-862) on one or more network-accessible operations, enabling authenticated low-privileged users to gain high-impact read and write access beyond their assigned roles. All major in-support Exchange branches are affected across specific build ranges. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score reflects substantial post-exploitation impact.
Local privilege escalation in Windows NTFS allows a low-privileged attacker to gain full system control by abusing improper symbolic or hard link resolution during file access. Affects Windows 11 versions 23H2 through 26H1 and Windows Server 2025, with patches tied to specific build thresholds confirmed via EUVD data. No public exploit identified at time of analysis; CVSS AC:H reflects a race condition or precise sequencing requirement characteristic of link-following primitives, moderating immediate urgency.
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. Patch is available from Microsoft; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated, low-privileged attacker to gain full system-level control without additional user interaction. The root cause is CWE-862 (Missing Authorization): the MDM component fails to enforce authorization checks on operations that should require elevated privileges, enabling an attacker who already has local access to escalate to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, but the low complexity and broad Windows footprint make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server allows a low-privileged authenticated network attacker to execute arbitrary code by supplying externally controlled file paths (CWE-73). Affected are Exchange Server 2016 CU23, 2019 CU14/CU15, and the Subscription Edition RTM release lines, all prior to their respective July 2026 patch levels. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft's history with Exchange RCE vulnerabilities makes this a high-priority remediation target for any organization running on-premises Exchange.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Win32K kernel subsystem (CWE-122) on Windows 11 and Windows Server 2025 enables a low-privileged local attacker to escalate to SYSTEM-level privileges. Affected builds span Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its Server Core variant, per EUVD-2026-73467. Microsoft has released patches addressing all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Use-after-free in Windows Remote Desktop Gateway Service enables an authorized network attacker to escalate privileges, with full confidentiality, integrity, and availability impact on affected Windows Server hosts. The vulnerability spans Windows Server 2012 through 2025 and specific Windows 10 builds, all addressed by patched builds released by Microsoft. No public exploit code has been identified at time of analysis and CISA KEV listing is absent; however, RD Gateway is a frequently internet-exposed service, making prompt patching operationally significant.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem allows a low-privileged local attacker to gain full system control on Windows 11 versions 24H2, 25H2, and 26H1. Exploitation requires high attack complexity, consistent with a race-condition-class UAF, but no user interaction is needed once the attacker has local code execution. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released a patch through the standard Patch Tuesday advisory cycle.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Microsoft Windows Search Component exposes Windows 11 and Windows Server 2022/2025 systems to full system compromise via a double-free memory corruption flaw. An authenticated, low-privileged attacker can trigger the vulnerability over the network with user interaction to gain SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, though a vendor patch is available.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Windows Push Notifications (WPN) exploits a use-after-free (CWE-416) to allow a low-privileged authenticated attacker to achieve full system compromise - confidentiality, integrity, and availability all rated High. The flaw spans Windows 11 (23H2 through 26H1) and Windows Server 2022/2025, with Microsoft confirming patch availability via the MSRC update guide. CVSS AC:H reflects a race-condition timing requirement that raises the exploitation bar above trivial one-shot attacks.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows Remote Desktop Gateway Service allows a low-privileged authorized attacker to achieve full system compromise via a double-free memory corruption flaw (CWE-415). Affected systems span Windows Server 2012 through 2025 and select Windows 10 builds where the RD Gateway role is installed. Microsoft has released patches across all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Microsoft Office enables remote unauthenticated attackers to achieve arbitrary code execution by convincing a target user to open a specially crafted Office document delivered over a network. All major Office perpetual and subscription releases are affected, spanning versions from Office 2016 through Microsoft 365 Apps for Enterprise and LTSC 2024. Vendor-released patches are available via Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis, though the high-impact, low-complexity CVSS profile warrants prioritized patching in enterprise environments.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows an authenticated low-privileged attacker to execute arbitrary code over the network by exploiting an improper access control flaw (CWE-284). The vulnerability affects build versions from 16.0.0 up to but not including 16.0.20326.20090, which Microsoft has patched. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.