Privilege Escalation
Monthly
Incorrect Authorization in Adobe Commerce allows remote unauthenticated attackers to escalate privileges and access sensitive information without any user interaction. The vulnerability, rooted in CWE-863, affects Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3, covering a broad range of production deployments. No public exploit code has been confirmed and CISA KEV does not list active exploitation, but SSVC flags the flaw as automatable, raising concern for mass-scanning campaigns against exposed storefronts.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. No public exploit or active KEV listing exists at time of analysis; Google addressed this in the September 2026 Android Security Bulletin.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'
Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.
Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.
Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's package installer component allows a low-privilege app to push unauthorized updates to other installed applications by exploiting a permissions bypass in InstallRepository.kt. Affected versions are Android 17 and Android 16-qpr2, as disclosed in the September 2026 Android Security Bulletin. No user interaction is required for exploitation; SSVC signals no confirmed active exploitation and EPSS sits at 0.13%, indicating limited real-world activity at time of analysis.
Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.
Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.
LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Background activity launch bypass in Android's RemoteViews framework allows a locally installed malicious application with basic user privileges to escalate to full device compromise without user interaction. Multiple functions in RemoteViews.java contain a logic error (CWE-693) that defeats Android's background activity launch (BAL) protection mechanism, enabling unprivileged apps to launch foreground activities from background context. Affecting Android 14, 15, 16, 16-QPR2, and 17, this has broad attack surface across the Android ecosystem; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Privilege escalation in Android's ActivityStarter component (Android 14 through 16-qpr2) allows a locally-installed application with standard permissions to launch background activities outside Android's background launch restrictions, achieving full device compromise. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error fails to properly enforce the protection mechanism (CWE-693) that prevents unauthorized background activity launches. No public exploit has been identified at time of analysis; EPSS stands at 0.12% (2nd percentile), consistent with the SSVC exploitation status of none.
Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the five-release breadth of affected versions spans the bulk of the active Android install base, making this a meaningful patch target.
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Weak password hashing in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables a local attacker with read access to project files to recover app-native user credentials through offline brute-force, then escalate privileges to a PIMBoards administrator account. The CWE-327 root cause - use of a broken or risky cryptographic algorithm for password storage - means hashes can be cracked computationally without network-side rate limiting or lockout defenses. Reported via ICS-CERT and covered under AVEVA security bulletin AVEVA-2026-006; no public exploit or CISA KEV listing is present at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher database roles via a weak authentication mechanism (CWE-1390). Affected releases span SQL Server 2017 through 2025 across both General Distribution Release (GDR) and Cumulative Update (CU) servicing branches. Microsoft has released patched builds for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Session fixation in Adobe Photoshop Mobile for Android (versions ≤1.6.0.2294 and ≤1.6.0.2299) enables privilege escalation by allowing an attacker to pre-establish or predict a victim's session token before authentication completes. When a victim interacts with an attacker-controlled malicious webpage, the fixed session identifier persists into the authenticated state, granting the attacker access to sensitive Adobe resources with elevated privileges. The S:C scope change in the vendor's CVSS vector indicates the compromised session likely extends beyond the app itself to Adobe backend services such as Creative Cloud. No public exploit has been identified at time of analysis.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Win32K allows an attacker who already holds low-privilege authenticated access to a target host to corrupt kernel stack memory and obtain SYSTEM-level code execution. The flaw is a stack-based buffer overflow (CWE-121) in the kernel-mode Windows subsystem driver reachable through win32k syscalls, affecting Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 on builds below the fixed levels. Despite the published 8.8 score using an AV:N vector, this is a local privilege-escalation primitive requiring a pre-existing foothold, no public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.70% (51st percentile); vendor patches are available and fully remediate the issue.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Privilege escalation in the Microsoft Windows TCP/IP kernel stack lets an authenticated attacker who already holds low privileges on a reachable host corrupt kernel memory over the network and escalate to SYSTEM, with high impact to confidentiality, integrity and availability. Exploitation hinges on winning a use-after-free race in tcpip.sys, which is why the vector carries AC:H and CISA SSVC rates the issue as not automatable with no observed exploitation; EPSS is 0.65 percent (49th percentile), and no public exploit was identified at time of analysis. All in-support Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds below the vendor's fixed revisions are affected, and Microsoft has released patches.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.
Incorrect Authorization in Adobe Commerce allows remote unauthenticated attackers to escalate privileges and access sensitive information without any user interaction. The vulnerability, rooted in CWE-863, affects Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3, covering a broad range of production deployments. No public exploit code has been confirmed and CISA KEV does not list active exploitation, but SSVC flags the flaw as automatable, raising concern for mass-scanning campaigns against exposed storefronts.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. No public exploit or active KEV listing exists at time of analysis; Google addressed this in the September 2026 Android Security Bulletin.
Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.
Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'
Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.
Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.
Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's package installer component allows a low-privilege app to push unauthorized updates to other installed applications by exploiting a permissions bypass in InstallRepository.kt. Affected versions are Android 17 and Android 16-qpr2, as disclosed in the September 2026 Android Security Bulletin. No user interaction is required for exploitation; SSVC signals no confirmed active exploitation and EPSS sits at 0.13%, indicating limited real-world activity at time of analysis.
Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.
Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.
LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.
Background activity launch bypass in Android's RemoteViews framework allows a locally installed malicious application with basic user privileges to escalate to full device compromise without user interaction. Multiple functions in RemoteViews.java contain a logic error (CWE-693) that defeats Android's background activity launch (BAL) protection mechanism, enabling unprivileged apps to launch foreground activities from background context. Affecting Android 14, 15, 16, 16-QPR2, and 17, this has broad attack surface across the Android ecosystem; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Privilege escalation in Android's ActivityStarter component (Android 14 through 16-qpr2) allows a locally-installed application with standard permissions to launch background activities outside Android's background launch restrictions, achieving full device compromise. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error fails to properly enforce the protection mechanism (CWE-693) that prevents unauthorized background activity launches. No public exploit has been identified at time of analysis; EPSS stands at 0.12% (2nd percentile), consistent with the SSVC exploitation status of none.
Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the five-release breadth of affected versions spans the bulk of the active Android install base, making this a meaningful patch target.
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Weak password hashing in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables a local attacker with read access to project files to recover app-native user credentials through offline brute-force, then escalate privileges to a PIMBoards administrator account. The CWE-327 root cause - use of a broken or risky cryptographic algorithm for password storage - means hashes can be cracked computationally without network-side rate limiting or lockout defenses. Reported via ICS-CERT and covered under AVEVA security bulletin AVEVA-2026-006; no public exploit or CISA KEV listing is present at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Local privilege escalation in Windows Security Center allows an authenticated low-privileged attacker to gain full system control through a use-after-free memory corruption flaw. Affected builds span Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2012 (including Server Core installations). Microsoft has released patches via the standard Update Guide; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in Windows NTFS via an out-of-bounds read (CWE-125) enables a low-privileged local attacker to gain full system-level access across a broad range of Windows desktop and server releases. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local user account with no user interaction and no special configuration. EPSS sits at 0.27% (19th percentile), suggesting limited opportunistic exploitation at this time, and no active exploitation is confirmed via CISA KEV.
Local privilege escalation in Microsoft SQL Server affects versions 2017 through 2025 via a use-after-free memory corruption flaw exploitable by an authenticated low-privilege user. An attacker with existing local access and SQL Server login credentials can trigger the UAF condition to achieve full C:H/I:H/A:H impact, effectively gaining elevated privileges on the host. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected CU and GDR servicing channels.
Privilege escalation in Microsoft SQL Server allows a network-authenticated low-privileged attacker to elevate to higher database roles via a weak authentication mechanism (CWE-1390). Affected releases span SQL Server 2017 through 2025 across both General Distribution Release (GDR) and Cumulative Update (CU) servicing branches. Microsoft has released patched builds for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Session fixation in Adobe Photoshop Mobile for Android (versions ≤1.6.0.2294 and ≤1.6.0.2299) enables privilege escalation by allowing an attacker to pre-establish or predict a victim's session token before authentication completes. When a victim interacts with an attacker-controlled malicious webpage, the fixed session identifier persists into the authenticated state, granting the attacker access to sensitive Adobe resources with elevated privileges. The S:C scope change in the vendor's CVSS vector indicates the compromised session likely extends beyond the app itself to Adobe backend services such as Creative Cloud. No public exploit has been identified at time of analysis.
Local privilege escalation in Windows Spaceport.sys, the Storage Spaces kernel driver, allows a low-privileged local user to execute arbitrary code at the kernel level across a broad range of Windows 10, 11, and Server editions. The CWE-125 out-of-bounds read in this kernel driver can be leveraged - under high-complexity conditions such as heap grooming - to corrupt adjacent kernel memory structures and redirect execution, yielding SYSTEM-level privileges. Microsoft has released patches for all affected builds, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Privilege escalation in Windows File History Service across Windows 10, Windows 11, and Windows Server 2016/2019 allows a locally authenticated low-privileged attacker to gain SYSTEM-level access by exploiting a use-after-free memory corruption flaw (CWE-416) in the service process. The CVSS 7.0 score reflects real exploitation difficulty - attack complexity is high, indicating dependence on heap layout conditions or race-condition timing typical of UAF bugs. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available from Microsoft.
Local privilege escalation in Windows Secure Socket Tunneling Protocol (SSTP) allows an authenticated low-privileged local attacker to achieve full SYSTEM-level control by exploiting a use-after-free (UAF) memory corruption condition in the SSTP kernel-mode driver. The vulnerability spans every currently-supported Windows client and server release, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Microsoft has released patched builds for all affected platforms; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Modern Device Management (MDM) allows a low-privileged authenticated user to achieve full system compromise via a use-after-free memory corruption flaw. Affected builds span Windows 10, Windows 11 (multiple feature versions), Windows Server 2019, 2022, and 2025, with fixed build numbers published by Microsoft. No public exploit identified at time of analysis, and the high attack complexity (AC:H) reflected in the CVSS 7.0 score indicates exploitation requires meeting specific memory-state conditions, likely a race condition or precise heap layout.
Privilege escalation via out-of-bounds read in the Windows Virtual Hard Disk (VHD) Miniport Driver affects a broad range of Windows 10, Windows 11, and Windows Server releases from Server 2012 through Server 2025. An authorized local attacker exploiting this CWE-125 flaw can achieve full control of the affected system - gaining high confidentiality, integrity, and availability impact - by reading kernel memory beyond legitimate buffer boundaries within the driver. No public exploit code has been identified at time of analysis, but the breadth of affected Windows builds and low attack complexity make this a significant enterprise patching priority.
Local privilege escalation in Windows Spaceport.sys - the kernel-mode Storage Spaces driver - allows a low-privileged authenticated local user to achieve SYSTEM-level control on Windows 11 and Windows Server 2022/2025 systems. The driver performs an out-of-bounds read (CWE-125) that can expose kernel memory contents and serve as a stepping stone to full kernel-level code execution, yielding high confidentiality, integrity, and availability impact. Microsoft has released patched builds via Windows Update; no public exploit or active exploitation confirmed at time of analysis.
Privilege escalation via use-after-free in the Windows Search Component affects a broad range of Microsoft Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker exploiting this memory-safety flaw can achieve full control of the affected system, gaining high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patched cumulative updates addressing the issue.
Local privilege escalation in Windows Error Reporting (WER) on Windows 11 and Windows Server 2025 is possible through a use-after-free (CWE-416) memory corruption flaw exploitable by a low-privileged authenticated user. The CVSS 7.0 vector (AV:L/AC:H/PR:L) indicates the attack requires local access and elevated complexity - consistent with a race condition or specific timing requirement to win the freed-memory reuse - but no user interaction once staged. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via use-after-free in the Windows Bluetooth Service allows a locally authenticated attacker to gain SYSTEM-level privileges on a broad range of Windows versions. The memory corruption vulnerability (CWE-416) requires low initial privileges and high attack complexity, consistent with a race condition in Bluetooth service memory management. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected branches.
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Advanced Local Procedure Call (ALPC) subsystem, via a use-after-free memory corruption flaw (CWE-416), enables a locally authenticated standard user to gain full control of an affected Windows system. The vulnerability spans an exceptionally broad product surface - from Windows Server 2012 through Windows 11 26H2 and Server 2025 - making it relevant to nearly every Windows deployment environment. Microsoft has released patches via the Security Response Center; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Privilege escalation via use-after-free in Windows Credential Providers allows a local, low-privileged authenticated attacker to gain full system control on Windows 11 and Windows Server 2025. The CWE-416 flaw exists in the credential provider subsystem, which handles authentication UI interactions; triggering the UAF condition (AC:H) under the right timing yields C:H/I:H/A:H impact. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows 11 and Server 2025 builds.
Local privilege escalation in the Windows Device Association Service enables an authenticated low-privileged attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability spans Windows 10, Windows 11, and Windows Server 2019 through 2025, representing an extraordinarily broad attack surface across enterprise and consumer environments. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the CVSS 7.0 rating reflects realistic difficulty from high attack complexity (AC:H).
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Win32K allows an attacker who already holds low-privilege authenticated access to a target host to corrupt kernel stack memory and obtain SYSTEM-level code execution. The flaw is a stack-based buffer overflow (CWE-121) in the kernel-mode Windows subsystem driver reachable through win32k syscalls, affecting Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2019, 2022 and 2025 on builds below the fixed levels. Despite the published 8.8 score using an AV:N vector, this is a local privilege-escalation primitive requiring a pre-existing foothold, no public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no', and EPSS is low at 0.70% (51st percentile); vendor patches are available and fully remediate the issue.
Privilege escalation in the Windows TCP/IP stack lets an attacker who already holds low-privileged authorized access on a reachable host trigger a kernel use-after-free and elevate to SYSTEM, with full compromise of confidentiality, integrity, and availability on the affected machine. The flaw affects a very broad install base - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - but exploitation is constrained by high attack complexity, since the attacker must reliably win a memory reclamation race in kernel space; Microsoft has shipped fixes and there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and no public exploit identified at time of analysis. EPSS is low at 0.52% (43rd percentile), so this is best handled as a routine but high-priority patch-cycle item rather than an emergency.
Privilege escalation in the Microsoft Windows TCP/IP kernel stack lets an authenticated attacker who already holds low privileges on a reachable host corrupt kernel memory over the network and escalate to SYSTEM, with high impact to confidentiality, integrity and availability. Exploitation hinges on winning a use-after-free race in tcpip.sys, which is why the vector carries AC:H and CISA SSVC rates the issue as not automatable with no observed exploitation; EPSS is 0.65 percent (49th percentile), and no public exploit was identified at time of analysis. All in-support Windows 10, Windows 11, Windows Server 2019, 2022 and 2025 builds below the vendor's fixed revisions are affected, and Microsoft has released patches.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Use-after-free (UAF) in the Windows Device Association Broker service enables a local, low-privileged authenticated attacker to escalate privileges to SYSTEM or higher on a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-416) is consistent with a race condition in the Broker's memory management, as reflected by the AC:H metric, and exploitation yields full confidentiality, integrity, and availability impact on the local system. No public exploit code has been identified at time of analysis, but Microsoft has released patches across all affected build streams.
Use-after-free memory corruption in Windows Audio Service enables local privilege escalation across the full Windows ecosystem, from Windows 10 1607 through Windows 11 26H1 and all supported Windows Server releases from 2012 through 2025. The CVSS vector (AV:L/AC:H/PR:L) confirms a locally authenticated attacker must navigate high-complexity exploit conditions - likely a race or timing attack on the audio service's memory lifecycle - before achieving full C:H/I:H/A:H impact, including arbitrary code execution at elevated privilege. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all listed affected builds.