Windows
Monthly
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
Path traversal in PeaZip's archive object preview handler allows a crafted archive entry to escape the extraction directory and be handed directly to ShellExecuteW, so a victim who opens a malicious archive on Windows and invokes 'Preview with... -> Associated application' (Shift+Ctrl+O) on the rogue entry can be made to launch an arbitrary program already present on their system without the usual dangerous-extension warning. Affected are PeaZip 11.2.0 and earlier on Windows; no authentication or elevated privileges are needed, but exploitation is interaction-gated (local file delivery plus a deliberate multi-step preview action, CVSS 4.0 base 8.4 with AV:L/UI:A/PR:N and high C/I/A impact). A proof of concept was demonstrated against official vendor builds on two archive formats (.zip and .tar), confirming the defect is in PeaZip's own path handling rather than a single format parser; no CISA KEV entry or independent confirmation of active exploitation was reported at time of analysis. The practical limitation is that the flaw launches programs that already exist at the resolved path (for example a system binary) rather than dropping new attacker-supplied binaries.
Improved privilege escalation via insecure default DCOM permissions in Mitsubishi Electric GENESIS64 (10.97.3 and prior), along with ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI (all 10.97.3 and prior) and MC Works64 (all versions), lets a holder of the product's administrator account launch and operate DCOM objects locally or remotely that would normally require UAC elevation, enabling disclosure, tampering, destruction or deletion of internal data and potential denial of service. Exploitation requires authenticated access to that administrator account (CVSS PR:H), so risk is concentrated in insider, credential-theft, or compromised admin-session scenarios rather than unauthenticated mass exploitation; the network-reachable vector and high confidentiality, integrity and availability impact (assessed CVSS:3.1 base 9.x, vendor CVSS:4.0 9.4) still make this a serious privilege-management flaw. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
Heap-based buffer overflow in Windows Kernel allows a low-privileged local attacker to elevate privileges on affected Windows 10, Windows 11, and Windows Server installations. Exploitation requires the attacker to already run code as a low-privileged local user; there is no remote trigger and no user interaction is required. No public exploit code has been identified at time of analysis, and vendor patches are available.
Local privilege escalation in the Windows Client License Service allows an authenticated low-privileged attacker to gain SYSTEM-level code execution by triggering a use-after-free (CWE-416) with a crafted local process, with high impact to confidentiality, integrity, and availability. Affected are unpatched Windows 10, Windows 11, and Windows Server builds (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2022 below 10.0.20348.5761); exploitation requires pre-existing local low-privileged access (CVSS AV:L/PR:L, UI:N) and no public exploit or active exploitation is identified at time of analysis, with SSVC reporting exploitation: none. This is a credible but not emergency-priority local privilege escalation driven by a post-foothold memory-corruption primitive.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
An out-of-bounds read in the Windows NTFS file system driver allows a locally authenticated attacker holding a low-privileged session to execute code with elevated privileges on the affected host. The flaw is triggered when NTFS processes attacker-influenced on-disk structures or volume metadata, giving a crafted or tampered NTFS volume a path to corrupt driver state within kernel context. Impact is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the vector is local-only with PR:L this is a privilege-escalation and post-exploitation primitive rather than an initial-access vector; no public exploit code and no confirmed active exploitation were identified at time of analysis. A vendor fix is available, and systems patched to the builds listed by Microsoft are not affected.
An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, producing a denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only hosts where the optional NDES role is installed and reachable over the network are exposed, spanning Windows Server 2012 through Windows Server 2025 plus Windows 10 versions 1607 and 1809, and Microsoft has published vendor fixes for these builds. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and real-world exposure is bounded because NDES is a deliberately deployed, non-default role rather than a component present on every Windows server.
Unauthenticated remote code execution in the Microsoft Failover Cluster Virtual Driver affects Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809 installations that have the Failover Clustering role enabled, where a double free (CWE-415) during processing of cluster network traffic allows an attacker to corrupt kernel memory and run code with SYSTEM privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Exposure is conditional rather than universal: the vulnerable driver is only loaded and reachable on clustered nodes, and in well-architected deployments the cluster communication path sits on a dedicated, isolated interconnect, which materially limits remote reach despite the network vector. There is no public exploit identified at time of analysis and no CISA KEV entry, but the vulnerability is fully automatable (SSVC: Exploitation none, Automatable yes, Technical Impact total) and vendor patches are available for all affected builds.
Out-of-bounds memory reads in Microsoft's Network Device Enrollment Service (NDES) allow a remote, unauthenticated attacker to disrupt certificate-enrollment service by sending crafted requests to a reachable SCEP endpoint, yielding a denial-of-service condition rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exposure is narrow in practice: NDES is an optional Active Directory Certificate Services role that is not present in a default Windows Server installation, so only hosts where the role has been deployed and its HTTP/HTTPS SCEP interface is network-reachable are at risk, and the vector requires no authentication, privileges, or user interaction. Impact is confined to availability - the assessed vector shows no confidentiality or integrity loss - and no public exploit identified at time of analysis, though vendor patches are available for all affected builds.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem lets an authenticated attacker holding low-privileged access on an affected host corrupt kernel memory via a use-after-free race and escalate to full system privileges. Microsoft rates it CVSS 7.8 (AV:L/PR:L/UI:N, with high confidentiality, integrity and availability impact) and has shipped fixed builds for Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025; no public exploit identified at time of analysis, and CISA's SSVC assessment records no known exploitation and marks the flaw as not automatable, since winning the UAF timing is attacker-dependent rather than reliably scriptable. Because the vector is entirely local and requires prior code execution in a low-privilege context, this is a credible but not emergency-level priority - it matters most as a post-compromise elevation step on unpatched builds.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Windows Hyper-V allows an authenticated, low-privileged user on a Hyper-V-enabled Windows host to trigger a use-after-free and execute code at a higher integrity level, ultimately reaching SYSTEM-level privileges on the host. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 builds prior to their fixed levels, and is only reachable once the attacker already holds local access on a system where the Hyper-V role is enabled. No public exploit identified at time of analysis, and CISA's SSVC decision framework records exploitation as none with the attack assessed as not automatable.
Local privilege escalation in Windows Assigned Access (kiosk mode) allows an authenticated, low-privileged local user to inject and execute code in a higher-integrity context, yielding full loss of confidentiality, integrity, and availability on the affected host (CVSS 3.1 base 7.8). Exploitation is constrained: the attacker must already hold authorized local logon (PR:L), the host must be one where an administrator has explicitly configured Assigned Access, and there is no network vector and no victim interaction (AV:L/UI:N). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and Microsoft has shipped fixed builds, so this is a credible but not emergency-level priority.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
Path traversal in PeaZip's archive object preview handler allows a crafted archive entry to escape the extraction directory and be handed directly to ShellExecuteW, so a victim who opens a malicious archive on Windows and invokes 'Preview with... -> Associated application' (Shift+Ctrl+O) on the rogue entry can be made to launch an arbitrary program already present on their system without the usual dangerous-extension warning. Affected are PeaZip 11.2.0 and earlier on Windows; no authentication or elevated privileges are needed, but exploitation is interaction-gated (local file delivery plus a deliberate multi-step preview action, CVSS 4.0 base 8.4 with AV:L/UI:A/PR:N and high C/I/A impact). A proof of concept was demonstrated against official vendor builds on two archive formats (.zip and .tar), confirming the defect is in PeaZip's own path handling rather than a single format parser; no CISA KEV entry or independent confirmation of active exploitation was reported at time of analysis. The practical limitation is that the flaw launches programs that already exist at the resolved path (for example a system binary) rather than dropping new attacker-supplied binaries.
Improved privilege escalation via insecure default DCOM permissions in Mitsubishi Electric GENESIS64 (10.97.3 and prior), along with ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI (all 10.97.3 and prior) and MC Works64 (all versions), lets a holder of the product's administrator account launch and operate DCOM objects locally or remotely that would normally require UAC elevation, enabling disclosure, tampering, destruction or deletion of internal data and potential denial of service. Exploitation requires authenticated access to that administrator account (CVSS PR:H), so risk is concentrated in insider, credential-theft, or compromised admin-session scenarios rather than unauthenticated mass exploitation; the network-reachable vector and high confidentiality, integrity and availability impact (assessed CVSS:3.1 base 9.x, vendor CVSS:4.0 9.4) still make this a serious privilege-management flaw. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV.
CVE-2026-16437 lets a locally authenticated administrator defeat the forgotten-password recovery mechanism in Mitsubishi Electric's ICONICS-based GENESIS (11.03 and prior), GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX (10.97.3 and prior) products, as well as all versions of MC Works64, GENESIS32 and BizViz, by tampering with the Windows-protected management file that stores the system-unlock challenge response - effectively unlocking the system without knowing the password. The impact ratings are high across confidentiality, integrity and availability, so a successful attacker could disclose, alter or destroy internal configuration data or drive the host into a denial-of-service condition. Realistic risk is tempered by the local-only vector, high attack complexity and the requirement for pre-existing administrative rights on the host; no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied for this CVE. Vendor CVSS is 7.1 (HIGH).
Command injection in the Markdown Preview Enhanced VS Code extension (which bundles the crossnote library) on Windows allows an attacker-controlled Markdown link to execute arbitrary commands with the privileges of the VS Code user. When a victim opens an untrusted Markdown file, previews it, and clicks a crafted external or unsupported-scheme link, the decoded link target is passed to a Windows file-opening helper that invokes child_process.exec with the start command, so embedded cmd.exe metacharacters are interpreted as command separators. The flaw affects versions prior to 0.8.28 (crossnote prior to 0.9.29), requires user interaction (opening the file and one link click), needs no workspace trust, no script execution, and no additional files, and earns a CVSS 3.1 base score of 8.8; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.
Code execution is possible in Epic Games Unreal Engine builds up to and including 5.8.0 on Windows because the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL) ships with an empty FURLRequestFilter, allowing every URL scheme - including file:/// - to pass through to ShellExecuteW() with the open verb, which executes the referenced file. The issue is reachable only in titles that ingest user-generated content containing Blueprints: the attacker must supply a malicious file locally or via a WebDAV share and the victim must load or interact with that content (unauthenticated remote/local attacker, CVSS 3.1 base 7.7, AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). No public exploit code has been identified at time of analysis; real-world risk is conditionally gated by the Windows-only dependency, the requirement that a game actually loads third-party Blueprints, mandatory user interaction, and high attack complexity.
Local privilege escalation in Hyland Desktop Host for Windows (all versions before 25.1.1) lets a low-privileged local user gain full administrative control of the host by abusing weak filesystem permissions on the directory from which a privileged service runs. The affected service executes out of %PROGRAMDATA%\Hyland\DesktopHost\bin, a location writable by non-administrative users; an attacker who can drop or replace a binary or library there and trigger a service (re)start causes that code to execute with the service's elevated (typically SYSTEM) context, yielding confidentiality, integrity, and availability impact across the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), although the attack is technically straightforward to reproduce on a shared or multi-user machine where an unprivileged account already exists.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Local privilege escalation in Windows Update Orchestrator affects Windows 10, Windows 11, and Windows Server 2025 systems; an authenticated local attacker with low privileges can trigger a double free (CWE-415) and potentially execute code at higher integrity, despite the high attack complexity that makes reliable exploitation difficult. The flaw requires an existing local session (PR:L, AV:L) and no user interaction (UI:N), and it is present by default on supported builds. Vendor patches are available from Microsoft; no public exploit code was identified in the provided intelligence, and there is no CISA KEV confirmation of active exploitation.
Local privilege escalation in OpenSSH for Windows allows an authenticated attacker to elevate privileges by triggering a double-free memory corruption. Affected builds include Windows 10, Windows 11, and Windows Server versions prior to the fixed builds listed in Microsoft's advisory. No public exploit identified at time of analysis; a vendor-released patch is available.
An authenticated, low-privileged local attacker can trigger a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) to corrupt kernel memory and elevate to SYSTEM on affected Windows 11 (24H2/25H2/26H1/26H2) and Windows Server 2022/2025 hosts. Exploitation is local-only and high-complexity (CVSS 7.0, AC:H), requiring precise kernel heap grooming or a race window, so this is a moderate-priority privilege-escalation issue rather than a remote or wormable emergency. No public exploit code has been identified at time of analysis, and Microsoft has released patched builds that remove the vulnerable condition.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated local attacker to trigger a use-after-free memory corruption and elevate privileges on affected Windows 10, Windows 11, and Windows Server hosts. Exploitation requires low-privilege local access (CVSS PR:L) and no user interaction; it is not remotely exploitable on its own, making it primarily a second-stage escalation after an initial foothold. Vendor patches are available, and no public exploit was identified at time of analysis.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Local privilege escalation in the Windows 11 26H1 kernel allows a low-privileged local user to corrupt heap memory and escalate to SYSTEM. The flaw is a heap-based buffer overflow (CWE-122) reachable with low attack complexity and no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), so an attacker who already holds a foothold as any user or service account can reliably and non-interactively raise their privileges to the highest level on the host. Exploitation is post-compromise, not a remote entry point; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Microsoft has shipped a vendor patch addressing it.
Local privilege escalation in the Windows Mobile Broadband (WWAN) component on Windows 11 allows an authenticated, low-privileged attacker to gain elevated privileges. The flaw is caused by incorrect permission assignment (CWE-732) on a critical resource, affecting default installations of Windows 11 24H2, 25H2, 26H1, and 26H2 below their respective patched revisions. No public exploit identified at time of analysis; exploitation requires local access and a low-privileged session, making it a post-compromise escalation vector.
Local privilege escalation in the Windows Audio Service lets an authenticated low-privilege user on affected Windows 11 builds (24H2, 25H2, 26H1, 26H2) have attacker-controlled content accepted as trusted, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. Exploitation is local-only and requires an existing foothold (PR:L) with no user interaction (UI:N) and low complexity (AC:L), so escalation is reliable once the attacker is on the host, though limiting factors are the mandatory authenticated local access and the fact that patched builds are not exploitable. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation in Windows Error Reporting allows an authenticated attacker holding a low-privileged account on the host to raise their privileges to SYSTEM-level by supplying crafted input containing argument delimiters to the reporting component (CWE-88 argument injection). Affected are unpatched Windows 10 (21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 installations below the vendor's fixed build levels. Successful exploitation yields high confidentiality, integrity and availability impact, but the attack is strictly local with a prior-authentication prerequisite (AV:L, PR:L, UI:N, AC:L), so it functions as a post-compromise escalation step rather than an initial-access vector; there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and a vendor patch is available.
Elevation of privilege in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows a locally positioned, low-privileged attacker to corrupt kernel heap memory and potentially gain SYSTEM-level code execution on affected Windows 11 and Windows Server hosts. Exploitation requires an existing foothold on the target - the attacker must already be able to run code locally (CVSS 3.1 AV:L/PR:L/UI:N, base score 7.8) - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and it cannot be triggered across the network. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing); the vendor has released fixed builds, making this a patch-priority issue for Windows environments rather than an emergency, with urgency driven mainly by the high confidentiality and integrity impact if a foothold already exists.
Local privilege escalation in the Windows Setup and Deployment component allows an attacker who already holds a low-privileged authenticated session on the host to invoke a critical setup/deployment function that performs no authentication check, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The flaw is not remotely reachable: it requires local access (AV:L), a pre-existing low-privileged account (PR:L), and the high attack complexity (AC:H) reflects an additional precondition such as a timing or state dependency during setup or deployment, so exploitation is a post-compromise escalation step rather than an initial-access or mass-exploitable vector. Affected platforms include Windows 11 (23H2 through 26H2/26H1), Windows 10 (1809, 21H2, 22H2), and Windows Server 2019, 2022, and 2025 including Server Core, and a vendor patch is available per the Microsoft MSRC advisory; no public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
A local elevation-of-privilege race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an attacker who already holds authenticated low-privilege local access to a Windows host win a time-of-check-to-time-of-use window inside the kernel-mode driver and gain higher-privilege code execution with full confidentiality, integrity and availability impact. Exploitation is constrained by the race itself: the CVSS vector rates complexity as High (AV:L/AC:H/PR:L/UI:N), meaning an attacker typically needs many repeated attempts and favorable scheduling rather than a single deterministic trigger, and no user interaction is required. There is no public exploit code and no active exploitation identified - no public exploit identified at time of analysis - and the risk is concentrated on hosts that actually exercise Windows container isolation; Microsoft has published fixes, so the realistic risk is unpatched container-heavy endpoints, servers and multi-tenant container hosts where an existing low-privileged user or container-adjacent process can reach the driver.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated remote attackers to execute arbitrary code when a user opens a crafted media file (UI:R). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers. No public exploit identified at time of analysis, but a vendor patch is available.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Remote code execution in the optional Microsoft Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) allows an unauthenticated, remote attacker to run arbitrary code in the context of the victim user by supplying a malformed RAW image file. Exploitation requires user interaction (CVSS UI:R) - the victim must open, preview, or let Explorer generate a thumbnail for the crafted file, which can be delivered via email, web download, or a network share - and requires the optional codec to be installed, since it is not present on default Windows installations (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor patch data indicates a fix is available. Overall this is a credible, patch-worthy priority but not a drop-everything emergency, given the dependency on the optional codec and on victim interaction with the malicious file.
Local privilege escalation in the Windows Servicing Stack Updates (SSU) component affects Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 (including Server Core installations) built below their respective fixed build thresholds, letting an attacker who already holds authenticated local access win a time-of-check time-of-use race and gain high-integrity code execution, confidentiality, and availability impact (CVSS 7.0, CWE-367). The high attack complexity reflects a narrow timing window that must typically be hit through repeated, precisely timed attempts, and no user interaction is required, though the attacker must already be present on the host with low privileges (PR:L, AV:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has released a patched servicing stack via its update guide.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated, low-privileged local user (CVSS PR:L) to elevate to a higher-integrity context, including SYSTEM, by triggering a use-after-free (CWE-416) in the search stack. Exploitation is constrained by High attack complexity (AC:H): the attacker must win a race/timing window and control reuse of the freed heap object, so reliable exploitation is conditions-dependent rather than one-shot, and there is no network vector or user-interaction requirement (AV:L, UI:N). Microsoft has released fixes in its update guide; no public exploit code was identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, making this a genuine but non-emergency privilege-escalation risk.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged access on a target host trigger a heap-based buffer overflow and execute code at a higher integrity level, up to full system rights (CVSS 7.8, AV:L/PR:L/UI:N). Unpatched Windows 10 builds from 1607 through 22H2, Windows 11 builds from 23H2 through 26H2, and Windows Server 2012 through 2025 are affected below the fixed revisions tracked in EUVD-2026-100258. No public exploit code has been identified at time of analysis, but vendor-released patches are available, making this a genuine patching priority for any endpoint or server where an attacker could obtain a local foothold.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows Virtualization-Based Security (VBS) Enclave allows an authenticated attacker who already holds low-privileged code execution on a VBS-enabled host to cross the enclave trust boundary and gain high-integrity code execution, carrying a CVSS 3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Patched builds are absent across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2016 through 2025, including Server Core installations. No public exploit code or confirmed active exploitation has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and automatable as no.
Heap-based buffer overflow in Windows Kernel allows a low-privileged local attacker to elevate privileges on affected Windows 10, Windows 11, and Windows Server installations. Exploitation requires the attacker to already run code as a low-privileged local user; there is no remote trigger and no user interaction is required. No public exploit code has been identified at time of analysis, and vendor patches are available.
Local privilege escalation in the Windows Client License Service allows an authenticated low-privileged attacker to gain SYSTEM-level code execution by triggering a use-after-free (CWE-416) with a crafted local process, with high impact to confidentiality, integrity, and availability. Affected are unpatched Windows 10, Windows 11, and Windows Server builds (for example, Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2022 below 10.0.20348.5761); exploitation requires pre-existing local low-privileged access (CVSS AV:L/PR:L, UI:N) and no public exploit or active exploitation is identified at time of analysis, with SSVC reporting exploitation: none. This is a credible but not emergency-priority local privilege escalation driven by a post-foothold memory-corruption primitive.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Remote code execution in Windows BitLocker is possible through a heap-based buffer overflow (CWE-122) that carries a 9.8 CVSS rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning unauthenticated remote attackers need no user interaction to trigger memory corruption that can yield full compromise of confidentiality, integrity, and availability on affected unpatched builds. Affected platforms include Windows 11 versions 23H2 through 26H2 (and 26H1), Windows Server 2022, and Windows Server 2025 including Server Core installations running builds below the patched thresholds listed by EUVD. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', though it flags the issue as automatable with total technical impact; the practical constraint is reachability, since BitLocker is a full-disk-encryption component normally exercised locally or during pre-boot/recovery rather than exposed as a default network service.
Local privilege escalation in the Windows Kernel lets an authenticated low-privileged user on unpatched Windows 11 (24H2, 25H2, 26H2) or Windows Server 2025 builds trigger a heap-based buffer overflow and execute code with SYSTEM-level privileges. Exploitation requires the attacker to already hold local access (PR:L, AV:L) and is complicated by a race on kernel heap state (AC:H), so it is not reliably triggerable on demand. No public exploit has been identified at time of analysis, patched builds are not exploitable, and this rates as a genuine but moderate-priority privilege-escalation issue rather than an emergency.
An out-of-bounds read in the Windows NTFS file system driver allows a locally authenticated attacker holding a low-privileged session to execute code with elevated privileges on the affected host. The flaw is triggered when NTFS processes attacker-influenced on-disk structures or volume metadata, giving a crafted or tampered NTFS volume a path to corrupt driver state within kernel context. Impact is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and because the vector is local-only with PR:L this is a privilege-escalation and post-exploitation primitive rather than an initial-access vector; no public exploit code and no confirmed active exploitation were identified at time of analysis. A vendor fix is available, and systems patched to the builds listed by Microsoft are not affected.
An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, producing a denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only hosts where the optional NDES role is installed and reachable over the network are exposed, spanning Windows Server 2012 through Windows Server 2025 plus Windows 10 versions 1607 and 1809, and Microsoft has published vendor fixes for these builds. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and real-world exposure is bounded because NDES is a deliberately deployed, non-default role rather than a component present on every Windows server.
Unauthenticated remote code execution in the Microsoft Failover Cluster Virtual Driver affects Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809 installations that have the Failover Clustering role enabled, where a double free (CWE-415) during processing of cluster network traffic allows an attacker to corrupt kernel memory and run code with SYSTEM privileges (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). Exposure is conditional rather than universal: the vulnerable driver is only loaded and reachable on clustered nodes, and in well-architected deployments the cluster communication path sits on a dedicated, isolated interconnect, which materially limits remote reach despite the network vector. There is no public exploit identified at time of analysis and no CISA KEV entry, but the vulnerability is fully automatable (SSVC: Exploitation none, Automatable yes, Technical Impact total) and vendor patches are available for all affected builds.
Out-of-bounds memory reads in Microsoft's Network Device Enrollment Service (NDES) allow a remote, unauthenticated attacker to disrupt certificate-enrollment service by sending crafted requests to a reachable SCEP endpoint, yielding a denial-of-service condition rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exposure is narrow in practice: NDES is an optional Active Directory Certificate Services role that is not present in a default Windows Server installation, so only hosts where the role has been deployed and its HTTP/HTTPS SCEP interface is network-reachable are at risk, and the vector requires no authentication, privileges, or user interaction. Impact is confined to availability - the assessed vector shows no confidentiality or integrity loss - and no public exploit identified at time of analysis, though vendor patches are available for all affected builds.
Local privilege escalation in Windows Management Instrumentation (WMI) through a heap-based buffer overflow allows an authenticated local attacker to elevate privileges on affected Windows hosts. Exploitation requires the attacker to already have low-privileged code execution on the target-this is not remotely exploitable and needs no user interaction (AV:L/PR:L/UI:N). Microsoft has released patches; no public exploit identified at time of analysis (SSVC exploitation: none).
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Update component of unpatched Windows 10, Windows 11, and Windows Server installations lets a user who already holds a low-privileged local account corrupt memory and elevate to a higher-integrity context. Exploitation is gated by two factors: the attacker must already have an authenticated local foothold (AV:L, PR:L, no user interaction required), and the use-after-free is rated high attack complexity (AC:H) because it requires reliably winning a timing/race window and controlling the contents of the freed allocation, which is non-deterministic and typically needs heap grooming. No public exploit code has been identified at time of analysis, the vulnerability is not a confirmed actively exploited (CISA KEV) item, and Microsoft has released fixes, making this a genuine but moderate-priority privilege-escalation issue rather than a remotely reachable or wormable threat.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Local privilege escalation in the Windows Kernel allows an authenticated low-privileged user who already has code execution on the host to elevate to SYSTEM-level privileges by winning a timing-sensitive use-after-free in kernel memory. The flaw affects Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2019, 2022, and 2025 builds below their respective patched build numbers; there is no remote or network path and no user interaction is required, but exploitation demands an existing local foothold and an account (PR:L) plus a non-trivial race condition (AC:H), so success is not guaranteed. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and the SSVC assessment records exploitation as 'none'; the CISA SSVC technical impact is rated 'total', and vendor patches are available.
Local privilege escalation in the Windows Push Notifications service allows an authenticated attacker with low-level user privileges to achieve high-integrity code execution by exploiting a missing authentication check (CWE-306) in a critical internal function. Scored CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access, no user interaction, and winning a non-deterministic condition due to high attack complexity; there is no public exploit identified at time of analysis. Affected builds of Windows 10, Windows 11, and Windows Server (2019 through 2025) below the fixed versions can be remediated with the Microsoft update.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in the Windows USB Print Driver (usbprint) lets an attacker who already holds a low-privileged local account corrupt kernel memory via a use-after-free and escalate to full system-level code execution on affected Windows 10, Windows 11, and Windows Server builds. The flaw is a race-condition-driven memory corruption (CWE-416, high attack complexity) that requires the attacker to win a timing window and reclaim a freed kernel object, so it functions as a post-compromise escalation primitive rather than a remote entry point; exploitation is rated CVSS 7.0 with high confidentiality, integrity, and availability impact. No public exploit code exists for this issue and it is not confirmed actively exploited (CISA KEV); Microsoft has released updates addressing the affected builds.
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
A use-after-free flaw (CWE-416) in the Windows USB Print Driver (usbprint.sys) allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows 10, Windows 11 and Windows Server builds that have not been updated. Exploitation requires the attacker to already hold low-privileged local access (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) and to trigger the vulnerable code path while winning a heap-reuse/race window, making success probabilistic rather than deterministic. Microsoft has released vendor patches, and there is no public exploit identified at time of analysis.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
A use-after-free (CWE-416) in the Windows USB Print Driver lets an attacker who already holds a local, low-privileged account on a Windows host escalate to SYSTEM-level privileges by racing the driver into reclaiming a freed memory object. Successful exploitation requires winning a timing window (AC:H, PR:L, AV:L, UI:N), so the flaw is not automatable per CISA's SSVC assessment (Exploitation: none, Automatable: no), and no public exploit code or evidence of active exploitation has been identified at time of analysis. Microsoft has released patched builds, and the CVSS 3.1 base score of 7.0 reflects high confidentiality, integrity, and availability impact confined to the local machine (S:U) - this is a moderate-priority local privilege escalation, not an emergency remote-compromise scenario.
Local privilege escalation in the Windows USB Print Driver enables an authenticated attacker with low-level privileges to achieve kernel-mode code execution by exploiting a use-after-free memory corruption condition (CWE-416). Microsoft has released patches covering Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2022/2025 (including Server Core). No public exploit code or confirmed active exploitation has been identified at time of analysis (not listed in CISA KEV), and the high attack complexity (AC:H) - requiring a race or specific memory-state condition - materially limits reliable exploitation, making this a post-foothold escalation rather than an emergency.
Local privilege escalation in the Microsoft Windows Win32 kernel subsystem lets an authenticated attacker holding low-privileged access on an affected host corrupt kernel memory via a use-after-free race and escalate to full system privileges. Microsoft rates it CVSS 7.8 (AV:L/PR:L/UI:N, with high confidentiality, integrity and availability impact) and has shipped fixed builds for Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025; no public exploit identified at time of analysis, and CISA's SSVC assessment records no known exploitation and marks the flaw as not automatable, since winning the UAF timing is attacker-dependent rather than reliably scriptable. Because the vector is entirely local and requires prior code execution in a low-privilege context, this is a credible but not emergency-level priority - it matters most as a post-compromise elevation step on unpatched builds.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Windows Hyper-V allows an authenticated, low-privileged user on a Hyper-V-enabled Windows host to trigger a use-after-free and execute code at a higher integrity level, ultimately reaching SYSTEM-level privileges on the host. The flaw carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), affecting Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 builds prior to their fixed levels, and is only reachable once the attacker already holds local access on a system where the Hyper-V role is enabled. No public exploit identified at time of analysis, and CISA's SSVC decision framework records exploitation as none with the attack assessed as not automatable.
Local privilege escalation in Windows Assigned Access (kiosk mode) allows an authenticated, low-privileged local user to inject and execute code in a higher-integrity context, yielding full loss of confidentiality, integrity, and availability on the affected host (CVSS 3.1 base 7.8). Exploitation is constrained: the attacker must already hold authorized local logon (PR:L), the host must be one where an administrator has explicitly configured Assigned Access, and there is no network vector and no victim interaction (AV:L/UI:N). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and Microsoft has shipped fixed builds, so this is a credible but not emergency-level priority.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Kernel allows an authenticated low-privileged user to gain elevated privileges by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation requires prior local code execution as a low-privileged user (PR:L, AV:L), has no user interaction (UI:N), and is made difficult by high attack complexity (AC:H) because the race/timing needed to trigger the freed object is not deterministic. This is a genuine but not top-tier priority; no public exploit identified at time of analysis, and SSVC records exploitation as none, with Microsoft providing vendor updates.
Local privilege elevation in Windows Autopilot on Windows 11 (24H2, 25H2, 26H1, and 26H2) lets an authenticated low-privileged attacker who already holds a foothold on the machine exploit a race condition in an improperly synchronized shared provisioning resource and reach a high-integrity context, with high impact to confidentiality, integrity, and availability. Because the flaw is a race condition (AC:H), exploitation is non-deterministic and typically requires repeated attempts to hit a narrow timing window, but no user interaction is needed and the attack stays local (AV:L, PR:L). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and a vendor patch is available, making this a moderate-priority local elevation-of-privilege issue rather than an emergency.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
A heap-based buffer overflow in the optional Microsoft Windows Raw Image Extension allows remote code execution in the context of the invoking process when a user opens or previews a crafted RAW image file. Affected versions are 2.1.0.0 up to but not including 2.4.36.0; because exploitation requires user interaction (UI:R) with a malicious file and is not automatable, systems that do not have the extension installed are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.