Microsoft
Monthly
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows any low-privileged authenticated user to execute arbitrary code on the server over the network via an improper access control flaw (CWE-284). The vulnerability carries a CVSS 8.8 with full C:H/I:H/A:H impact triad, meaning successful exploitation yields complete compromise of the SharePoint server. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but on-premises SharePoint deployments represent high-value enterprise targets warranting priority patching.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition (below 16.0.20326.20090) allows a low-privileged authenticated attacker to execute arbitrary code over the network by exploiting improper access control. The flaw, rooted in CWE-284, permits an authorized user to exceed their intended permissions and trigger server-side code execution without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated network attacker with low-level database credentials to achieve full remote code execution on the SQL Server host. The CVSS 8.8 (PR:L) rating reflects that any valid SQL Server login - not just a DBA - can trigger the overflow, making this dangerous in environments with broad user bases or shared credentials. No public exploit has been identified at time of analysis, but patches are available from Microsoft across all affected major versions.
Heap-based buffer overflow in Microsoft SQL Server (2017 through 2025) enables network-reachable, low-privileged authenticated attackers to execute arbitrary code on the database server. With CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), exploitation requires only a valid database login - no administrative privileges or user interaction - making this a credible lateral-movement vector in environments with reachable SQL Server instances. Vendor patches are available across all affected GDR and CU servicing tracks; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2025 allows a network-authenticated low-privileged attacker to achieve remote code execution against affected database instances. Both the GDR servicing branch (below 17.0.1135.8) and the CU8 cumulative update branch (below 17.0.4085.5) are vulnerable. Microsoft has released patches via MSRC; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network attacker to execute arbitrary code on the database host. The vulnerability (CWE-122) resides in a network-reachable code path, requiring only valid SQL Server credentials - no elevated database roles or special configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the full CIA impact and low attack complexity make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server 2025 is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow in the database engine. The flaw (CWE-122) affects both the GDR and CU8 cumulative update branches of SQL Server 2025, requires only a low-privilege database login (PR:L per CVSS), and yields full confidentiality, integrity, and availability impact upon successful exploitation. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege attacker to execute arbitrary code over the network with scope-changed impact. The CWE-125 memory safety flaw in the database engine is reachable via standard SQL Server network access, and the scope-changed CVSS vector (S:C) indicates successful exploitation can escape the SQL Server process boundary to affect the underlying host. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the AC:H metric signals non-trivial exploitation complexity, but the breadth of affected versions across three major SQL Server release branches demands priority patching.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release (GDR) servicing tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft SQL Server enables a low-privileged authenticated attacker to remotely execute arbitrary code on the database server. All major active SQL Server branches are affected - 2017, 2019, 2022, and the newly released 2025 edition - across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) triggered over a network connection by a low-privileged authenticated attacker. The vulnerability spans all major in-support release branches including GDR and Cumulative Update servicing tracks, with fixed builds identified across eight distinct release configurations. No active exploitation has been confirmed in CISA KEV, but the low attack complexity and broad version coverage make this a high-priority patch target for any organization running SQL Server on the network perimeter or in multi-tenant environments.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Remote code execution in Microsoft SQL Server allows an authenticated low-privilege attacker to exploit an untrusted pointer dereference (CWE-822) over the network, achieving full compromise of the host with scope change beyond the database engine. Affected instances span SQL Server 2019, 2022, and 2025 across both Cumulative Update and GDR servicing branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high complexity rating (AC:H) and scope change (S:C) signal a serious memory corruption primitive when conditions are met.
Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SQL Server 2025 is achievable by low-privileged authenticated attackers over the network via a heap-based buffer overflow (CWE-122). Both the GDR (General Distribution Release) and CU8 (Cumulative Update 8) servicing tracks for SQL Server 2025 are affected, spanning version ranges 17.0.1050.2-17.0.1135.8 and 17.0.0.0-17.0.4085.5 respectively. Vendor patches are available through the Microsoft Security Response Center; no public exploit code or active exploitation has been identified at the time of analysis.
SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacker to escalate privileges within the database engine. The flaw exists across all current servicing tracks - both cumulative update (CU) and general distribution release (GDR) branches - for SQL Server 2017, 2019, 2022, and 2025. No public exploit code or active exploitation has been identified at time of analysis, but vendor-released patches are available for all affected versions.
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to exploit improper symbolic link resolution during SQL Server file operations to gain high-level control over the host system across the network. The root cause is CWE-59 (link following): SQL Server resolves file system links without validating the resolved path, enabling a low-privilege login to redirect the high-privilege SQL Server service account into accessing or overwriting attacker-controlled targets. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version scope - spanning all major SQL Server releases still in mainstream support - make patching an immediate operational priority.
Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. Patch is available from Microsoft; no public exploit code or active exploitation (CISA KEV) confirmed at time of analysis.
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. Vendor-released patches are available across all affected branches; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Remote code execution in Microsoft Dynamics 365 on-premises version 9.1 (prior to build 9.1.0046.0006) is achievable by an authenticated low-privileged attacker via deserialization of untrusted data over the network. The CWE-502 flaw allows crafted serialized objects to be processed without adequate validation, yielding full confidentiality, integrity, and availability compromise of the affected server. No public exploit code has been identified at time of analysis; Microsoft has released a patch addressing this vulnerability.
Privilege elevation in Microsoft SQL Server Management Studio (SSMS) 22 before 22.8.2 lets a remote attacker inject unneutralized special elements into output processed by a downstream component, escalating privileges over the network when a user is induced to interact (UI:R). Although the NVD description names 'SQL Server,' the EUVD affected-product list scopes the flaw to the SSMS client tool, indicating a client-side injection rather than a database-engine defect. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and no KEV listing.
Privilege escalation via permissive cross-domain policy in the Azure Arc SQL Server Extension (versions < 1.1.3518.465) allows a remote unauthenticated attacker to leverage a victim's authenticated session to make cross-origin API calls and elevate privileges over the network. The flaw stems from an overly permissive CORS/cross-domain policy that trusts untrusted external domains, enabling attacker-controlled pages to issue privileged requests on behalf of a visiting authenticated user. No public exploit has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
External file path control in Microsoft Office Word enables local code execution with full confidentiality, integrity, and availability impact when a target user opens a specially crafted document. All major Office release tracks are affected across Windows and macOS - Office 2016, 2019, 2021 LTSC, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and vendor patches are available through the Office security release channel.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Heap-based buffer overflow in the Microsoft Windows Codecs Library (HEVC Video Extensions) enables local privilege escalation on Windows systems. Three distinct Store app variants - the base edition, the licensed-application edition, and the device-manufacturer-bundled edition - are all affected across specific version ranges. An attacker who can deliver a specially crafted HEVC media file and induce a local user to open it gains full C:H/I:H/A:H impact, effectively achieving code execution at an elevated privilege level. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft HEVC Video Extensions (Windows Codecs Library) enables local code execution with the full privileges of the targeted user when a victim opens or previews a specially crafted HEVC/H.265 video file. Three distinct distribution variants of the codec are affected - the standalone Store app, the device-manufacturer-bundled version, and the licensed-applications edition - all requiring upgrade to their respective patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis, but the user-interaction trigger (opening a video file) creates a viable social engineering vector.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Exchange Server 2019 (CU14, CU15, and Subscription Edition) is possible via a double-free memory corruption vulnerability (CWE-415) exploitable by an unauthenticated remote attacker with no user interaction required. The CVSS vector AC:H signals that exploitation is technically complex, likely requiring precise heap-grooming to control the freed memory region and redirect execution, which constrains opportunistic mass exploitation. Microsoft has released fixes across all affected update channels; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition allows any low-privileged authenticated user to execute arbitrary code on the server over the network via an improper access control flaw (CWE-284). The vulnerability carries a CVSS 8.8 with full C:H/I:H/A:H impact triad, meaning successful exploitation yields complete compromise of the SharePoint server. No confirmed active exploitation or public proof-of-concept is identified at time of analysis, but on-premises SharePoint deployments represent high-value enterprise targets warranting priority patching.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Microsoft SharePoint Server Subscription Edition (below 16.0.20326.20090) allows a low-privileged authenticated attacker to execute arbitrary code over the network by exploiting improper access control. The flaw, rooted in CWE-284, permits an authorized user to exceed their intended permissions and trigger server-side code execution without any user interaction. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation via absolute path traversal in the Windows Search Component affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2022/2025, allowing a locally authenticated standard user to achieve full system compromise. The flaw (CWE-36) lets an attacker supply a crafted absolute path that the Search Component processes without adequate sanitization, enabling reads or writes to privileged file system locations outside the intended scope. Microsoft has released cumulative update patches for all affected versions; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Heap-based buffer overflow in the Microsoft Account component of Windows 11 and Windows Server 2025 enables local privilege escalation to full system access. An authorized local attacker with standard user-level privileges exploits CWE-122 heap corruption to gain complete control over confidentiality, integrity, and availability of the affected host. Vendor-released patches are available for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Use-after-free in the Windows Bind Filter Driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The flaw (CWE-416) resides in a kernel-mode filter driver, meaning successful exploitation yields full control over the operating system. No public exploit or active exploitation has been identified at time of analysis, but Microsoft has released patches addressing the affected builds.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server allows a low-privileged local attacker to execute arbitrary code with full confidentiality, integrity, and availability impact on the SQL Server host. Affected versions span four major release generations - SQL Server 2017 through 2025 - across both Cumulative Update and GDR servicing tracks, indicating a systemic code path defect rather than an isolated regression. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available for all affected builds.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated network attacker with low-level database credentials to achieve full remote code execution on the SQL Server host. The CVSS 8.8 (PR:L) rating reflects that any valid SQL Server login - not just a DBA - can trigger the overflow, making this dangerous in environments with broad user bases or shared credentials. No public exploit has been identified at time of analysis, but patches are available from Microsoft across all affected major versions.
Heap-based buffer overflow in Microsoft SQL Server (2017 through 2025) enables network-reachable, low-privileged authenticated attackers to execute arbitrary code on the database server. With CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), exploitation requires only a valid database login - no administrative privileges or user interaction - making this a credible lateral-movement vector in environments with reachable SQL Server instances. Vendor patches are available across all affected GDR and CU servicing tracks; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2022 and 2025 allows a low-privileged, network-authenticated attacker to achieve remote code execution against the database engine. The vulnerability is reachable over the network with low complexity, requiring only a valid SQL Server login - no elevated privileges or user interaction. Patch has been released by Microsoft across both GDR and Cumulative Update servicing branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2025 allows a network-authenticated low-privileged attacker to achieve remote code execution against affected database instances. Both the GDR servicing branch (below 17.0.1135.8) and the CU8 cumulative update branch (below 17.0.4085.5) are vulnerable. Microsoft has released patches via MSRC; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Microsoft SQL Server 2017 through 2025 enables an authenticated low-privilege network attacker to execute arbitrary code on the database host. The vulnerability (CWE-122) resides in a network-reachable code path, requiring only valid SQL Server credentials - no elevated database roles or special configuration. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the full CIA impact and low attack complexity make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server 2025 is achievable by a network-authenticated attacker exploiting a heap-based buffer overflow in the database engine. The flaw (CWE-122) affects both the GDR and CU8 cumulative update branches of SQL Server 2025, requires only a low-privilege database login (PR:L per CVSS), and yields full confidentiality, integrity, and availability impact upon successful exploitation. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated low-privilege attacker to execute arbitrary code over the network with scope-changed impact. The CWE-125 memory safety flaw in the database engine is reachable via standard SQL Server network access, and the scope-changed CVSS vector (S:C) indicates successful exploitation can escape the SQL Server process boundary to affect the underlying host. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the AC:H metric signals non-trivial exploitation complexity, but the breadth of affected versions across three major SQL Server release branches demands priority patching.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to achieve remote code execution with full confidentiality, integrity, and availability impact. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and General Distribution Release (GDR) servicing tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; vendor patches are available from Microsoft.
Heap-based buffer overflow in Microsoft SQL Server enables a low-privileged authenticated attacker to remotely execute arbitrary code on the database server. All major active SQL Server branches are affected - 2017, 2019, 2022, and the newly released 2025 edition - across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in Microsoft SQL Server enables a network-authenticated low-privileged attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact. Affected versions span all actively serviced SQL Server releases from 2017 through 2025, across both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. No public exploit or CISA KEV listing has been identified at time of analysis, but the low authentication barrier (any valid SQL Server login) and network accessibility make this a high-priority patching target in enterprise environments.
Remote code execution in Microsoft SQL Server affects versions 2017 through 2025 via an integer overflow that triggers a heap-based buffer overflow in the database engine. An authenticated low-privileged attacker reachable over the network can exploit this flaw to achieve full system compromise - confidentiality, integrity, and availability all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds across all affected version branches.
Heap-based buffer overflow in Microsoft SQL Server enables an authenticated, low-privileged network attacker to escalate privileges to full control of the database instance. Affected versions span SQL Server 2017 through the newly released SQL Server 2025 across both Cumulative Update (CU) and General Distribution Release (GDR) servicing tracks. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in Microsoft SQL Server 2017 through 2025 via a heap-based buffer overflow (CWE-122) triggered over a network connection by a low-privileged authenticated attacker. The vulnerability spans all major in-support release branches including GDR and Cumulative Update servicing tracks, with fixed builds identified across eight distinct release configurations. No active exploitation has been confirmed in CISA KEV, but the low attack complexity and broad version coverage make this a high-priority patch target for any organization running SQL Server on the network perimeter or in multi-tenant environments.
Stack-based buffer overflow in Microsoft SQL Server 2019, 2022, and 2025 enables an authenticated network attacker with low-level privileges to execute arbitrary code, with scope change enabling impact beyond the SQL Server process itself. The vulnerability carries CVSS 8.5 (S:C) with high confidentiality, integrity, and availability impact, indicating that successful exploitation can compromise not just the database engine but potentially the underlying OS. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though CVSS AC:H reflects meaningful exploitation complexity requiring careful payload construction against modern memory protections.
Remote code execution in Microsoft SQL Server allows an authenticated low-privilege attacker to exploit an untrusted pointer dereference (CWE-822) over the network, achieving full compromise of the host with scope change beyond the database engine. Affected instances span SQL Server 2019, 2022, and 2025 across both Cumulative Update and GDR servicing branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high complexity rating (AC:H) and scope change (S:C) signal a serious memory corruption primitive when conditions are met.
Denial-of-service via integer overflow in Microsoft SQL Server allows unauthenticated remote attackers to crash the database service over a network connection. Affected versions span SQL Server 2017 through 2025 across both Cumulative Update and GDR branches. Microsoft has released patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft SQL Server 2025 is achievable by low-privileged authenticated attackers over the network via a heap-based buffer overflow (CWE-122). Both the GDR (General Distribution Release) and CU8 (Cumulative Update 8) servicing tracks for SQL Server 2025 are affected, spanning version ranges 17.0.1050.2-17.0.1135.8 and 17.0.0.0-17.0.4085.5 respectively. Vendor patches are available through the Microsoft Security Response Center; no public exploit code or active exploitation has been identified at the time of analysis.
SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacker to escalate privileges within the database engine. The flaw exists across all current servicing tracks - both cumulative update (CU) and general distribution release (GDR) branches - for SQL Server 2017, 2019, 2022, and 2025. No public exploit code or active exploitation has been identified at time of analysis, but vendor-released patches are available for all affected versions.
Privilege escalation in Microsoft SQL Server 2017 through 2025 allows any low-privileged authenticated database user to exploit improper symbolic link resolution during SQL Server file operations to gain high-level control over the host system across the network. The root cause is CWE-59 (link following): SQL Server resolves file system links without validating the resolved path, enabling a low-privilege login to redirect the high-privilege SQL Server service account into accessing or overwriting attacker-controlled targets. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version scope - spanning all major SQL Server releases still in mainstream support - make patching an immediate operational priority.
Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. Patch is available from Microsoft; no public exploit code or active exploitation (CISA KEV) confirmed at time of analysis.
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. Vendor-released patches are available across all affected branches; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege escalation in Microsoft SQL Server (versions 2017, 2019, 2022, and 2025) allows a low-privileged authenticated user to elevate their database permissions to a higher role over the network via CWE-269 improper privilege management. With a CVSS 8.8 score and vector AV:N/AC:L/PR:L, the flaw requires only a valid SQL Server login - no attack complexity, no user interaction - and yields full confidentiality, integrity, and availability impact on the database instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the near-zero exploitation prerequisites within a widely deployed enterprise platform make urgent patching essential.
Privilege escalation in Microsoft SQL Server allows an authenticated low-privileged network attacker to gain complete control over affected database instances across SQL Server 2017, 2019, 2022, and 2025. The flaw stems from CWE-1220 (Insufficient Granularity of Access Control), where the access control model fails to enforce fine-grained permission boundaries, permitting a standard database login to exceed its intended privilege scope. No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified, but the broad version coverage and full C:H/I:H/A:H CVSS impact make patching urgent. Vendor-released patches are available across all affected release tracks.
Remote code execution in Microsoft Dynamics 365 on-premises version 9.1 (prior to build 9.1.0046.0006) is achievable by an authenticated low-privileged attacker via deserialization of untrusted data over the network. The CWE-502 flaw allows crafted serialized objects to be processed without adequate validation, yielding full confidentiality, integrity, and availability compromise of the affected server. No public exploit code has been identified at time of analysis; Microsoft has released a patch addressing this vulnerability.
Privilege elevation in Microsoft SQL Server Management Studio (SSMS) 22 before 22.8.2 lets a remote attacker inject unneutralized special elements into output processed by a downstream component, escalating privileges over the network when a user is induced to interact (UI:R). Although the NVD description names 'SQL Server,' the EUVD affected-product list scopes the flaw to the SSMS client tool, indicating a client-side injection rather than a database-engine defect. Reported by Microsoft with a patch available; no public exploit identified at time of analysis and no KEV listing.
Privilege escalation via permissive cross-domain policy in the Azure Arc SQL Server Extension (versions < 1.1.3518.465) allows a remote unauthenticated attacker to leverage a victim's authenticated session to make cross-origin API calls and elevate privileges over the network. The flaw stems from an overly permissive CORS/cross-domain policy that trusts untrusted external domains, enabling attacker-controlled pages to issue privileged requests on behalf of a visiting authenticated user. No public exploit has been identified at time of analysis, but a vendor-released patch is available.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
External file path control in Microsoft Office Word enables local code execution with full confidentiality, integrity, and availability impact when a target user opens a specially crafted document. All major Office release tracks are affected across Windows and macOS - Office 2016, 2019, 2021 LTSC, LTSC 2024, and Microsoft 365 Apps for Enterprise. No public exploit has been identified at time of analysis, and vendor patches are available through the Office security release channel.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Heap-based buffer overflow in the Microsoft Windows Codecs Library (HEVC Video Extensions) enables local privilege escalation on Windows systems. Three distinct Store app variants - the base edition, the licensed-application edition, and the device-manufacturer-bundled edition - are all affected across specific version ranges. An attacker who can deliver a specially crafted HEVC media file and induce a local user to open it gains full C:H/I:H/A:H impact, effectively achieving code execution at an elevated privilege level. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft HEVC Video Extensions (Windows Codecs Library) enables local code execution with the full privileges of the targeted user when a victim opens or previews a specially crafted HEVC/H.265 video file. Three distinct distribution variants of the codec are affected - the standalone Store app, the device-manufacturer-bundled version, and the licensed-applications edition - all requiring upgrade to their respective patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis, but the user-interaction trigger (opening a video file) creates a viable social engineering vector.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Local privilege escalation in Microsoft's Trace Data Helper (TDH) component - a Windows Event Tracing subsystem library - allows a low-privileged authenticated local user on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 to gain full SYSTEM-level control. The root cause is an out-of-bounds read (CWE-125) that enables disclosure of kernel memory contents sufficient to defeat address-space layout randomization and chain into a full privilege escalation, yielding C:H/I:H/A:H impact. No active exploitation has been identified and no public proof-of-concept is available; Microsoft has released patched builds across all affected OS versions.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Exchange Server 2019 (CU14, CU15, and Subscription Edition) is possible via a double-free memory corruption vulnerability (CWE-415) exploitable by an unauthenticated remote attacker with no user interaction required. The CVSS vector AC:H signals that exploitation is technically complex, likely requiring precise heap-grooming to control the freed memory region and redirect execution, which constrains opportunistic mass exploitation. Microsoft has released fixes across all affected update channels; no public exploit code or CISA KEV listing has been identified at time of analysis.