Windows 10 1607
Monthly
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.
Remote code execution in Windows Error Reporting (WER) allows an unauthenticated, remote attacker to trigger a heap-based buffer overflow (CWE-122) and execute arbitrary code with full system impact. The vulnerability is rated CVSS 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, but the profile is consistent with a wormable RCE risk if a network-facing WER path is exposed.
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
Remote code execution risk in the Windows Partition Management Driver (CVE-2026-97805) stems from an out-of-bounds read that Microsoft rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), meaning an unauthenticated remote attacker with no user interaction could reach the vulnerable code path in unpatched Windows 10, Windows 11, and Windows Server 2012-2025 builds; our independent assessment keeps PR:N/UI:N but raises attack complexity to high (AC:H), since reliably converting a kernel out-of-bounds read into remote code execution is difficult against Windows kernel mitigations such as ASLR and kernel-mode protections, and network reachability of the partition driver path is the practical gate. Microsoft has released fixes per the MSRC advisory; no public exploit identified at time of analysis, and there is no CISA KEV entry.
Local privilege escalation in the Windows HID class driver lets an authenticated attacker who already holds a low-privileged foothold on the host elevate to SYSTEM-level code execution. Exploitation requires local authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), with crafted input or IOCTL requests to the HID driver - a component present by default on every affected Windows client and server SKU, so no non-default feature or special configuration is needed. There is no publicly available exploit code and no confirmed active exploitation identified at time of analysis, but successful exploitation yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), making timely patching a credible priority rather than an emergency-tier one; no EPSS score was provided in the source data.
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Local code execution in the Windows Universal Disk Format File System Driver (UDFS) affects all supported Windows 10, Windows 11, and Windows Server editions when the driver parses a malformed UDF volume. Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so a crafted or corrupted UDF-formatted optical disc or UDF/ISO image file must be mounted or read on the target host before the flaw can be reached; a successful trigger provides full confidentiality, integrity, and availability impact within the kernel context. No public exploit code has been identified at time of analysis and no confirmed active exploitation (CISA KEV) has been reported, and our independent assessment rates this as a credible but not emergency-tier priority given the mandatory local foothold and physical/media-adjacent delivery path.
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then execute arbitrary commands, yielding high impact to confidentiality, integrity, and availability. The attack is network-reachable with low complexity but requires victim interaction (CVSS UI:R) - the target must open or interact with attacker-supplied content such as a crafted file, shortcut, or link - which is why SSVC rates it non-automatable while still flagging total technical impact. The flaw affects Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, plus Outlook.com, and is confirmed actively exploited (CISA KEV); given the KEV listing and the assessed high-end impact, this is a genuine top-tier patching priority rather than a high-CVSS-but-low-risk case.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS.sys) allows an authenticated attacker with low-privilege code execution to trigger a use-after-free by coaxing the kernel driver into parsing attacker-controlled UDF data, typically via a crafted optical disc, ISO, VHD, or removable volume/image; successful exploitation yields high confidentiality, integrity, and availability impact at SYSTEM level (CVSS 7.8, CWE-416). Default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 are affected below the fixed build numbers listed in the vendor data. There is no remote or unauthenticated path and no drive-by network vector, and no public exploit identified at time of analysis; the primary constraint is that the attacker must already hold a foothold and be able to force UDFS mount/parse operations.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated, low-privileged attacker to execute code at higher integrity by exploiting a use-after-free race condition. Affected systems span Windows 10, Windows 11, and Windows Server 2012 through 2025; the attacker must present or mount a crafted UDF volume while winning a narrow timing window (AC:H). No public exploit code identified at time of analysis, and the flaw is not listed in CISA KEV.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an authenticated attacker who can already run code on a Windows host to obtain SYSTEM-level privileges by driving the driver into a use-after-free (CWE-416) while it parses a crafted UDF volume, typically a malicious ISO/DVD image or UDF-formatted device. The issue is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and affects Windows 10, Windows 11 and Windows Server 2012 through 2025 releases below the fixed builds published in Microsoft's update for CVE-2026-96947; vendor patches are available and no public exploit identified at time of analysis. Because the attack is strictly local and cannot be reached over the network, it is a post-compromise privilege-escalation step rather than an initial-access vector, making it a patch-priority item for Windows estates rather than an emergency.
Use-after-free in the Windows Universal Disk Format File System (UDFS) driver enables local privilege escalation to SYSTEM for an attacker who already has low-privileged code execution on a target machine. Exploitation requires the attacker to mount or attach a crafted UDF-formatted volume (e.g., ISO, optical disc, or disk image) that triggers a memory corruption condition (CWE-416) in the kernel-mode driver; no victim interaction is needed. Microsoft has released patches addressing the flaw, and no public exploit code or active exploitation has been observed at time of analysis, though the CVSS 7.8 score reflects the high confidentiality, integrity, and availability impact if successfully exploited.
Unauthenticated remote code execution in the Windows DHCP Server role lets any attacker who can deliver DHCP protocol traffic to a vulnerable server trigger a use-after-free in the service's message processing and potentially run code in its context. Every supported Windows Server generation is affected when the DHCP Server role is installed - Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, plus the Windows 10 1607 and 1809 client builds that ship the same component - with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirming no credentials and no user interaction are required. Microsoft has released fixes, and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the ease of triggering and the total loss of confidentiality, integrity and availability make unpatched, network-exposed DHCP servers a high-priority patch target.
Local privilege escalation in the Windows COM+ Event System Service allows an authenticated low-privileged user to elevate to a high-integrity level (e.g., SYSTEM) via an untrusted pointer dereference (CWE-822), achieving full confidentiality, integrity, and availability impact. Affected systems span a wide range of Windows client and server editions, from Windows 10 1607 through Windows 11 26H2 and Windows Server 2012 through 2025. No public exploit code or active exploitation has been identified at the time of analysis, but a vendor patch is available.
Local privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds low-privileged, authenticated access to a Windows host race a shared resource against the service and escalate to SYSTEM-level privileges (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H). The flaw is a classic race condition (CWE-362) in which improper synchronization during concurrent access to a shared resource corrupts state, and the high attack-complexity rating reflects that the attacker must reliably hit a narrow timing window - a significant exploit-reliability constraint, though no victim interaction is required. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2016 through 2025, and the exposure is limited to machines where an attacker can already obtain local code execution as a non-admin user; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft.
Local privilege escalation in the Windows NTFS kernel-mode filesystem driver lets an attacker who already holds a low-privileged, authenticated session on an unpatched Windows host trigger an untrusted pointer dereference and run code at a higher privilege level, typically SYSTEM. The defect is rated CVSS 3.1 7.8 (HIGH) with high confidentiality, integrity, and availability impact, and because the vector is AV:L/PR:L/UI:N/S:U it is a post-compromise escalation step rather than a remote initial-access vector: the attacker needs local code execution and no special non-default Windows feature enabled. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), but vendor patches are available and should be applied promptly to Windows 10, Windows 11, and Windows Server 2012 through 2025 builds.
Local privilege escalation in the Windows NTFS filesystem driver (CVE-2026-96928) allows an attacker who already holds a low-privileged, authenticated local session - or who controls a low-privilege process able to touch the NTFS driver - to trigger an out-of-bounds read in kernel mode and elevate to SYSTEM. The defect affects default NTFS configurations across Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, requires no user interaction and is low complexity, but remains strictly local (AV:L), so exposure is limited to insiders, malware with an existing foothold, or post-compromise lateral movement. Microsoft has published vendor fixes via the MSRC update guide; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none', making this a credible local escalation primitive rather than an emergency remote threat.
Untrusted pointer dereference in Windows OLE (Object Linking and Embedding) permits remote code execution on unpatched Windows systems, with the vulnerable component processing an attacker-supplied OLE object such as an embedded object inside a document, email, or other file. The vendor-declared CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8), but our independent assessment scores it 9.8 with AC:H/UI:R, reflecting that successful exploitation realistically requires a victim to open or preview crafted content and that the attacker must control both the dereferenced pointer and the surrounding memory layout to gain code execution. Exploitation status is currently negative: CISA's SSVC decision framework rates Exploitation as "none," no CISA KEV listing is present, and no public exploit code has been identified at time of analysis, though the flaw is fully automatable (SSVC Automatable: yes) with total technical impact if triggered. Vendor patches are available, and every Windows build below the fixed build numbers listed in the EUVD data remains exposed.
Use-after-free in the Windows Workstation Service (LanmanWorkstation), the SMB client service that is present and running by default on every supported Windows edition, allows an attacker who already holds a low-privileged local account or local code execution to escalate privileges on the host. The trigger is a memory-lifetime race, so exploitation requires winning a timing window between the release of an object and its reuse, which the assessed vector captures as AV:L/AC:H/PR:L/UI:N with High confidentiality, integrity and availability impact; there is no remote or network-facing vector and no user interaction is required. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but moderate-priority patch item rather than an emergency, with fixes already published by Microsoft.
Local privilege escalation in the Windows Program Compatibility Assistant Service (PcaSvc) allows an authenticated low-privileged user to trigger a heap-based buffer overflow (CWE-122) and elevate to higher privileges. The flaw affects numerous Windows 10, 11, and Server editions; exploitation requires local access and a pre-existing low-privilege foothold (CVSS 7.8 High, AV:L/PR:L). Vendor patches are available and no public exploit has been identified at time of analysis.
Privilege escalation in the Windows NTFS filesystem driver allows an authenticated local attacker holding only standard-user rights to reliably obtain SYSTEM-level access on unpatched builds. The weakness is an improper access control condition (CWE-863) that requires low attack complexity and no user interaction, making it a dependable post-foothold escalation step once an attacker already has local code execution - for example via phishing, an existing low-privileged account, or a chained remote bug - rather than a remotely reachable or unauthenticated issue. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, so this is a genuine but second-tier patching priority; Microsoft has shipped fixes for all listed client and server editions, so exposure is limited to hosts still below the fixed build numbers.
Heap-based buffer overflow in the Windows NTFS kernel driver allows a user who already holds a low-privileged authenticated local session to trigger a crafted NTFS operation and elevate to SYSTEM-level privileges, with high confidentiality, integrity and availability impact (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is strictly local: it cannot be launched remotely, requires an existing foothold on the host, and needs no user interaction, but the attack complexity is low; the main limiting factor is the need for pre-existing local code execution. Because NTFS is the default filesystem, all unpatched Windows 10, Windows 11 and Windows Server 2012 through 2025 builds listed by the vendor are affected, and Microsoft has released fixes, making this a patch-now priority for Windows fleets even though it is not a remote-code-execution bug; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Kernel-Mode Drivers lets an authenticated attacker who already holds low-privileged local access on a Windows host run crafted code against a kernel driver interface and gain SYSTEM-level code execution, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N). Every supported Windows client and server branch is affected, from Windows Server 2012 through Windows Server 2025 and Windows 10/11 releases up to the fixed build thresholds published by Microsoft. Microsoft has released a fix in its update guide for CVE-2026-96915, and there is no public exploit identified at time of analysis - no CISA KEV listing, no POC, and no evidence of exploitation in the wild - so this is a patch-now hardening priority rather than an internet-facing emergency.
Local privilege escalation in the Windows TCP/IP stack (CVE-2026-96852, CVSS 7.0) allows an attacker who already holds authenticated, low-privileged code execution on a Windows host to trigger a use-after-free in kernel TCP/IP handling and elevate to SYSTEM privileges. The access vector is strictly local (AV:L/PR:L) with no user interaction, but the decisive constraint is high attack complexity (AC:H) - the flaw is a race condition that must be won reliably, and CISA's SSVC assessment rates it non-automatable with exploitation status 'none', so signals point to a moderate-priority patch rather than an emergency. Microsoft has published a vendor fix through its Update Guide; no public exploit code has been identified at time of analysis.
Local privilege elevation in Microsoft Windows WebDAV allows an authenticated, low-privileged user with an existing interactive session on the host to trigger an untrusted pointer dereference inside the WebDAV component and obtain high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Exploitation is not remote and requires pre-existing local access, and CISA's SSVC decision framework rates it non-automatable with exploitation set to none, so it is not wormable and no public exploit identified at time of analysis. Realistic risk is concentrated on shared, multi-user, or terminal-server hosts where untrusted users can obtain interactive local sessions, and Microsoft has released fixed builds for all affected Windows 10, Windows 11, and Windows Server versions.
Privilege escalation in the Microsoft Bluetooth Driver lets an attacker within Bluetooth radio range who already holds low-privilege authenticated access escalate to full compromise of confidentiality, integrity, and availability (CVSS 8.0, AV:A/PR:L/UI:N). Affected builds span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 that have not been updated to the fixed build numbers in the vendor advisory. No public exploit has been identified at time of analysis, and CISA's SSVC rates exploitation as none and automatable as no, although technical impact is total; exploitation also requires Bluetooth to be enabled and the attacker to be physically adjacent, so internet-facing systems are not at risk.
Heap-based buffer overflow in the Windows WebDAV implementation lets a locally authenticated attacker with only low privileges corrupt heap memory and elevate privileges on the same host, yielding high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U). Exploitation requires a pre-existing foothold - code execution as a normal user on the target and reachable WebDAV/WebClient functionality - so this is a post-compromise privilege-escalation primitive rather than a remote entry point, and CISA's SSVC assessment marks it non-automatable, i.e. not suited to wormable mass exploitation. No public exploit code and no active exploitation have been identified at time of analysis, but Microsoft has shipped patches and real-world risk is concentrated on multi-user hosts such as RDS/terminal servers and shared workstations where several low-privileged users can run code.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Local privilege escalation in the Microsoft Windows Search Component allows an authenticated attacker who already holds low-privileged code execution on a Windows host to abuse a use-after-free and elevate to higher integrity, with the CVSS vector (AV:L/AC:L/PR:L/UI:N, 7.8, C/I/A all High) confirming that the local-access and authenticated prerequisites are the only real barriers. Exploitation requires no user interaction and no non-default configuration, making this a useful post-compromise escalation primitive rather than an initial-access vector. Microsoft has released vendor patches and no public exploit identified at time of analysis, and there is no KEV listing, so this is best treated as a high-priority patch item rather than an emergency.
Local privilege escalation in the Windows Remote Desktop Protocol component allows an authenticated, low-privileged user on an affected Windows host to win a race against freed memory and execute code with higher privileges, up to SYSTEM on the local machine. Successful exploitation requires an existing local foothold with valid credentials plus a high-complexity, timing-dependent trigger (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N), making this a post-compromise escalation step rather than a remote entry point. Microsoft has published a fix for the affected servicing branches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in the Windows DHCP Server role affects Windows Server 2012 through 2025 (including Server Core) as well as Windows 10 1607 and 1809, and can be triggered by an unauthenticated attacker who can deliver a crafted DHCP message to the service, which in practice means residing on the same broadcast segment or having the traffic forwarded by a DHCP relay agent since DHCP is not natively routed across subnets. The underlying heap-based buffer overflow (CWE-122) yields full confidentiality, integrity, and availability impact, matching the CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Vendor patches are available per Microsoft's advisory, there is no CISA KEV entry and no public exploit code identified at the time of analysis, although CISA's SSVC rates the flaw as fully automatable with total technical impact.
Local privilege escalation in the Windows Resume component lets an authenticated attacker holding only standard user privileges on the host trigger a heap-based buffer overflow and execute code in an elevated security context, typically SYSTEM. Successful exploitation is limited to the local host and requires prior authenticated access (CVSS 3.1 7.8 High; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so the flaw is realistically a post-compromise escalation step rather than a remote or unauthenticated initial-access vector. No public exploit code identified at time of analysis, and Microsoft has released a vendor patch via its update guide.
Heap-based buffer overflow in the Windows Kernel lets an authenticated attacker who already holds low-level local privileges escalate to full kernel-level code execution (SYSTEM) on the affected host, with high impact to confidentiality, integrity and availability. The flaw is reachable across a very wide swath of supported builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, including Server Core installations - so any unpatched host in those ranges is exposed by default. Microsoft has published a fix, and at time of analysis there is no CISA KEV entry and no public exploit code identified; because the CVSS vector is AV:L/PR:L, the attacker must first obtain local authenticated access, which makes this a post-compromise privilege-escalation primitive rather than a remote entry point.
Local privilege escalation in Windows Installer (msiexec) allows an authenticated local attacker with existing low-privileged code execution to elevate to SYSTEM by triggering a use-after-free memory corruption flaw. The vulnerability affects unpatched Windows 10, Windows 11, and Windows Server builds below the fixed build levels listed in Microsoft's update guidance, including Windows 11 24H2 below 10.0.26100.9711 and Windows Server 2025 below 10.0.26100.33650. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Local privilege escalation in the Windows Installer (msiexec/msiserver) component lets an already-authenticated, low-privileged local user corrupt memory and escalate to SYSTEM on affected Windows client and server builds. The defect is a use-after-free race condition, so exploitation demands precise timing and may fail under hardened or heavily loaded conditions, but a successful run yields full confidentiality, integrity, and availability impact on the host. It affects default configurations of Windows 10, Windows 11, and Windows Server 2012 through 2025 prior to the vendor's patched builds; per CISA's SSVC assessment exploitation is 'none' and no public exploit code has been identified at time of analysis, while a vendor patch is available per the Microsoft advisory.
Local privilege escalation in the Windows SysMain (Superfetch) service (CVE-2026-96306, CVSS 3.1 base 7.8 High) allows an authenticated low-privileged user who already has code execution on a Windows host to exploit an out-of-bounds read in the service and obtain elevated privileges, with high impact across confidentiality, integrity, and availability. The flaw is local-only (AV:L), low complexity (AC:L), requires low privileges (PR:L) and no user interaction (UI:N), so it cannot be used for initial access and is confined to post-compromise escalation. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); a vendor patch is available from Microsoft.
Local privilege escalation in the Microsoft Windows Installer service (msiexec) lets an authenticated, low-privileged attacker who already holds a local foothold on a host trigger a use-after-free and gain full confidentiality, integrity and availability impact on that machine at a higher privilege level (CVSS 7.0, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H). Because the attack complexity is high, exploitation almost certainly hinges on winning a memory-reuse timing race, making success non-deterministic and potentially requiring repeated attempts; no user interaction is needed and no public exploit identified at time of analysis. Microsoft has shipped fixes for all supported Windows 10, Windows 11 and Windows Server builds enumerated in the EUVD ranges, so risk is concentrated on unpatched endpoints rather than on remote attack surface.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged user to trigger a use-after-free (CWE-416) in the installer component and elevate to higher-integrity code execution on the same host. The flaw carries CVSS 3.1 base score 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local-only, requires an existing low-privileged account, needs no victim interaction, and is timing-dependent because the race must be won (AC:H). It affects a very broad footprint of supported Windows client and server editions, including Server Core installations, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Automatable: no; signals are consistent and point to a moderate, non-urgent priority, with vendor-released fixes already available.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
Local privilege escalation in the Windows Internal System User Profile component lets an authenticated attacker who already holds low-privileged access on a Windows host run a crafted local program to trigger a use-after-free (CWE-416) and obtain elevated privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an existing foothold and the ability to execute code locally - there is no remote or network path and no user interaction - and CISA's SSVC assessment rates the flaw non-automatable (Automatable: no), reflecting the precision needed to control memory reallocation timing for a reliable UAF. No public exploit has been identified at time of analysis, and there is no CISA KEV listing or confirmed active exploitation; affected builds span Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2016/2019/2022/2025 below the fixed build numbers published by the vendor.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the Windows NTFS file system driver allows an authenticated attacker holding only low-level user privileges to trigger a heap-based buffer overflow (CWE-122) through crafted filesystem operations, yielding high confidentiality, integrity, and availability impact on the host. The attack is purely local (AV:L), requires no user interaction (UI:N), and needs no race condition or unusual timing (AC:L), so its main limiting factor is the prerequisite foothold - it functions as a post-compromise escalation step rather than a remotely reachable bug. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and Microsoft has published a security update covering the affected Windows 10, Windows 11, and Windows Server builds.
Local privilege escalation in Windows Network File System (NFS) allows an authenticated low-privileged user to gain elevated rights on affected Windows hosts where the NFS server role is enabled. The vulnerability is an out-of-bounds read (CWE-125) with a high attack complexity (AC:H), likely requiring a race condition or specific memory state to trigger, which limits reliable exploitation. Microsoft has released patches, and no public exploit code or active exploitation has been identified at time of analysis. This is a moderate-severity elevation-of-privilege issue rather than a top-tier emergency.
Local privilege escalation in Microsoft Windows Media Foundation lets an authenticated, low-privileged attacker who already has a foothold on the host run code at higher integrity by supplying specially crafted serialized data that Media Foundation deserializes. Under the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) no user interaction is needed and the escalation is reliable once local access exists, but the bug cannot be triggered remotely or by an unauthenticated actor, making it strictly a post-compromise escalation step. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows Graphics Kernel allows an authenticated low-privileged user who already has the ability to run code on an affected host to trigger an out-of-bounds read (CWE-125) inside a kernel-mode graphics component and reach SYSTEM-level execution, consistent with the assessed CVSS 7.8 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Every affected platform is a default Windows installation - Windows 10 and Windows 11 client builds plus Windows Server 2012 through 2025, including Server Core - and the only prerequisite is the pre-existing local foothold, with no remote or unauthenticated path. Microsoft has published fixes and no public exploit code was identified at time of analysis.
Unauthenticated remote code execution affects the Windows DNS Server role across Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, driven by a heap-based buffer overflow (CWE-122) that a network attacker can trigger by sending crafted DNS messages to an affected host. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation is remote, unauthenticated, low-complexity and requires no user interaction once the DNS Server service is installed and reachable - making internet-exposed, forwarding or recursive resolvers the highest-risk deployments, while purely internal-only resolvers simply narrow the attacker population to those with network access. This is a genuine top-tier priority rather than a high-score-but-low-risk artifact, though no public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV); Microsoft has released fixes through the MSRC update guide, so the primary exposure is unpatched hosts rather than a lack of remediation.
Heap-based buffer overflow in Microsoft Windows Media Player enables remote code execution when the component processes attacker-supplied media content such as a crafted file or network stream. The vendor scoring places this at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), describing unauthenticated, no-interaction compromise with total confidentiality, integrity, and availability impact; the affected parsing library ships on essentially every Windows 10, Windows 11, and Windows Server build listed below the patched revision, so the exposed install base is extremely broad. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, while also flagging the flaw as Automatable: yes with Technical Impact: total, meaning exploitation is expected to be trivially repeatable once a working input is produced. The primary practical gating factor is that a victim must open or play the malicious media, so the assessed real-world vector is UI:R even though the vendor vector claims UI:N.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in the Windows DWM Core Library (dwmcore.dll) allows an attacker who already holds a low-privileged, interactive foothold on a Windows host to trigger an out-of-bounds read in the compositor and leverage it to gain higher-integrity code execution, with full loss of confidentiality, integrity and availability if successful. The affected component ships and runs by default across Windows 10, Windows 11 (through the 26H2 servicing branch) and Windows Server 2016 through 2025, including Server Core installs, so every supported desktop and server edition is in scope. The CVSS vector (AV:L/PR:L/UI:N) makes this a second-stage escalation primitive rather than a remote entry point, and there is no public exploit identified at time of analysis - meaning it is a patch-now item for managed fleets, not an emergency.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Exploiting an out-of-bounds read (CWE-125) in the Windows Desktop Window Manager (DWM) Core Library allows a local, authenticated attacker with low privileges to elevate to higher privileges on all supported Windows 10/11 and Windows Server 2016-2025 editions, including Server Core. The flaw requires a pre-existing local foothold (AV:L/PR:L) and no user interaction, so it cannot be triggered remotely and must be chained with initial access. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none', and Microsoft has released vendor patches.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated, low-privileged user on an affected Windows host trigger a use-after-free in the search indexing/query path and escalate to higher-integrity code execution, with high impact across confidentiality, integrity, and availability (CVSS 7.8, AV:L/PR:L/UI:N). Because Windows Search is present and enabled by default on every supported client and server build listed in EUVD-2026-100108, no non-default configuration is required - the only prerequisite is an existing standard user session or foothold on the target, making this a post-exploitation escalation step rather than a remotely reachable flaw. Neither CISA KEV nor the SSVC assessment indicates active exploitation (Exploitation: none), and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-level priority that should be closed through routine monthly patching.
Untrusted pointer dereference in Microsoft Windows DNS Server enables a remote, unauthenticated attacker to execute arbitrary code in the context of the DNS service on an affected host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms no authentication is required but also shows that some triggering interaction or processing of an attacker-influenced DNS response is needed, which meaningfully narrows opportunistic internet-wide exploitation compared with a purely unsolicited inbound-packet bug. Exposure is limited to Windows Server 2016/2019/2022/2025 (including Server Core) and supported Windows 10/11 client builds running the DNS Server role below the patched build levels; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the high severity and network reachability justify prompt patching.
Remote code execution in the Microsoft Windows DNS Server role is possible when the service processes attacker-influenced DNS data that triggers an untrusted pointer dereference (CWE-822). Affected builds span Windows Server 2016, 2019 (including Server Core), 2022 and 2025 as well as Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2 through 26H2, and the issue is rated CVSS 8.8 with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning unauthenticated remote triggering but with a UI:R component - the DNS service must actually be driven to resolve or parse the crafted record rather than being crashed by a single unsolicited packet. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, so the practical risk currently rests on theoretical severity and the broad installed base rather than observed attacks; a vendor patch is available, which makes prompt build-level upgrading the decisive control.
Remote code execution in Windows DNS Server (CVSS 8.8, CWE-822) allows an unauthenticated, network-positioned attacker to gain code execution when the service dereferences an untrusted pointer while processing crafted DNS data. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation requires that the server be induced through a user- or operator-driven resolution path, which is the primary factor keeping realistic risk below a fully wormable remote exploit; only hosts with the DNS Server role installed, enabled, and network-reachable are affected. Vendor patches are available, and no public exploit identified at time of analysis.
Local privilege escalation in the Windows Broadcast DVR User Service (bcastdvr) lets an attacker who already holds low-privilege code execution on a Windows 10 or Windows 11 host corrupt memory and elevate to a higher-integrity context. The defect is a use-after-free (CWE-416) triggered through the per-user DVR/broadcast service, and it carries a CVSS 3.1 base of 7.8 under the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction and unchanged scope but high confidentiality, integrity, and availability impact once the service context is abused. This is a purely local escalation primitive, not a remote entry point: no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no', though technical impact is rated 'total'.
Elevation of privilege in Microsoft's Input Method Editor (IME) lets an authenticated local attacker who already holds a low-privileged Windows session abuse weak authentication in the IME component to obtain full confidentiality, integrity, and availability impact on the host. The flaw is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction, but because the vector is local and privileged (PR:L) it is a post-compromise escalation rather than an initial-access path. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit has been identified at time of analysis; Microsoft has published a fix through its Security Update Guide, so risk is concentrated on unpatched, shared multi-user hosts such as RDP/terminal servers and kiosks.
Local privilege escalation in Windows Security Support Provider Interface (SSPI) lets an attacker who already holds a low-privileged local session on a Windows host run code at a higher integrity level, ultimately up to SYSTEM, by supplying a pointer that the component dereferences without validation. All supported branches are exposed - Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, below the fixed build numbers published by the vendor. High attack complexity (AC:H) points to a non-deterministic trigger such as a race or a precise memory layout, so reliability is attacker-dependent; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, making this a second-stage escalation primitive rather than an urgent remote threat. The vendor has released patches and Microsoft lists the issue as requiring an authorized (authenticated, low-privileged) local attacker.
Local privilege escalation in Windows DCOM Server allows an authenticated low-privileged local attacker to exploit a race condition (CWE-362) and gain elevated privileges on affected Windows systems. The vulnerability affects a wide range of Windows 10, 11, and Windows Server editions, and a vendor patch is available per the Microsoft advisory. No public exploit code has been identified at time of analysis.
Local privilege escalation in Windows Management Instrumentation (WMI) lets an authenticated attacker with only low-privilege access on a Windows host elevate to SYSTEM or administrator privileges by feeding crafted serialized data into a vulnerable WMI deserialization path. Successful exploitation requires an existing local foothold and valid credentials (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) and requires no user interaction, so it is not remotely reachable and cannot be triggered by an unauthenticated attacker. No public exploit identified at time of analysis and there is no confirmed active exploitation (CISA KEV) for this issue; a vendor patch is available from Microsoft, so risk is concentrated in environments where attackers have already established a low-privilege presence and where patch cycles are slow.
Local privilege escalation in Microsoft Windows Installer (msiexec) allows an authenticated low-privileged attacker who already has code execution on a target Windows host to trigger a use-after-free memory corruption and gain elevated (SYSTEM/administrator) rights, with no user interaction required. The flaw affects supported Windows 10/11 and Windows Server 2012 through 2025 builds where the installer is enabled by default, so it is a post-compromise escalation vector rather than an initial-access path. Vendor patches are available and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft Windows Installer allows a local, authenticated attacker with low privileges to gain elevated rights on affected Windows hosts. The flaw is a NULL pointer dereference (CWE-476) in the Installer service, rated CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires a specific runtime condition (high attack complexity) but can lead to full compromise of confidentiality, integrity, and availability. Microsoft has released patches; no public exploit code has been identified at time of analysis. Affected systems include Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025.
Local privilege escalation in Windows BitLocker allows a low-privileged, already-authenticated user on an affected Windows 10, Windows 11, or Windows Server host to exploit an out-of-bounds read (CWE-125) in the BitLocker component, leaking memory contents and ultimately gaining SYSTEM-level privileges. The attack is purely local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the attacker to first hold a valid foothold with local code execution - there is no remote or network-triggerable path. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and Microsoft has released vendor patches for all impacted builds.
Local privilege escalation in Windows Installer (MSI) lets an attacker who already holds low-level authenticated access to a host trigger a use-after-free and execute code with full impact to confidentiality, integrity, and availability, escaping the confines of their original user context. Exploitation is strictly local, requires no victim interaction, and is gated by high attack complexity - a narrow heap-reuse or race window must be won, which lowers reliability and typically demands repeated attempts. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (no CISA KEV listing), and because Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, this is a moderate-priority update rather than an emergency-patch item.
Use-after-free in the Windows Bluetooth Port Driver (bthport.sys) lets an attacker positioned within Bluetooth radio range of an unpatched Windows host elevate privileges, with no authentication and no user interaction required (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 7.5 High). Real-world risk is constrained by high attack complexity - the attacker must reliably win a non-deterministic race in driver memory handling - and by the prerequisites of physical proximity and an active Bluetooth stack; CISA's SSVC assessment records no observed exploitation and no automatable path (Technical Impact: total). Microsoft has published vendor patches, and no public exploit code has been identified at time of analysis.
A use-after-free (CWE-416) in the Windows Quality of Service (QoS) Packet Scheduler allows a locally authenticated low-privileged attacker to elevate privileges to a higher integrity level, including SYSTEM, with high impact to confidentiality, integrity and availability (CVSS 7.8). Exploitation requires the attacker to already hold local code execution on the target host as at least a low-privileged user (AV:L, PR:L), so this is a post-foothold privilege-escalation primitive rather than a remote entry point, and no user interaction is required (UI:N). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded by prior local access and by patch deployment; Microsoft has released fixes covering Windows 10, Windows 11 and Windows Server 2012 through 2025.
Local privilege escalation in Microsoft Windows Installer allows an authenticated attacker holding low-privilege access on a Windows host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to trigger a stack-based buffer overflow and run code in a higher-integrity context, with full confidentiality, integrity, and availability impact and no user interaction required. The vulnerability is not remotely reachable and cannot be triggered without an existing foothold on the machine, making it a post-compromise escalation primitive rather than an initial access vector - the primary factor limiting real-world risk. No public exploit code was identified at time of analysis, the issue is not confirmed as actively exploited, and vendor-released patches are available for all affected Windows client and server builds.
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated, remote attacker to run arbitrary code on hosts that expose the SSTP VPN service over the network. Successful exploitation requires a use-after-free race to be reliably triggered and won, which is why the flaw carries a high attack-complexity rating (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) despite needing no credentials and no user interaction; the realistic exposure is limited to Windows 10/11 and Windows Server 2012 through 2025 machines configured as Routing and Remote Access (RRAS) SSTP VPN gateways, typically listening on TCP/443, since SSTP is not enabled on default installs. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); Microsoft has released fixed builds, so risk is concentrated in unpatched, internet-facing SSTP endpoints. This is a serious but conditionally-gated flaw whose practical severity depends entirely on whether the SSTP role is installed and reachable.
Local privilege elevation in Windows BitLocker lets an attacker who already holds a valid low-privileged account on the machine exploit a time-of-check-to-time-of-use race condition to gain higher privileges, including read and modify access to protected data (C:H/I:H/A:H). Because the vector is AV:L with PR:L, the attacker must already have a foothold on the host, and AC:H together with CISA SSVC Automatable=no means the race window is non-deterministic and exploitation is not reliably repeatable; exploitation also depends on BitLocker being in active use on the target. No public exploit code has been identified at time of analysis and there is no KEV entry or SSVC exploitation signal, so this is a moderate-priority hardening issue rather than an emergency; patches are available from Microsoft per its update guide.
Local privilege elevation in the Windows Universal Plug and Play (UPnP) Device Host allows an attacker who already holds a low-privileged authenticated account on the machine to reuse a freed memory object and gain SYSTEM-level code execution, data disclosure, or denial of service. Exploitation is local only (AV:L, PR:L) and is gated by a high-complexity race condition (AC:H), so it does not apply to remote or unauthenticated attackers and success is non-deterministic even with a valid foothold. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so this is a genuine but not top-tier priority relative to its 7.0 base score. Vendor patches are available per the Microsoft advisory.
Privilege escalation in the Windows Embedded Mode Service lets an attacker who already holds local, authenticated access on a vulnerable Windows 10, Windows 11 or Windows Server host corrupt memory and elevate to a higher-integrity (likely SYSTEM) context, with High confidentiality, integrity and availability impact under CVSS 7.0. The root cause is a use-after-free (CWE-416) in the service, and because the assessed vector is AV:L/AC:H/PR:L/UI:N, exploitation is local-only, requires an existing low-privileged foothold, and depends on winning a narrow timing race between the free and reuse of the object - making it non-deterministic and typically requiring repeated attempts. No public exploit code was identified at time of analysis and CISA's SSVC decision data records Exploitation as 'none', so this rates as a real but not urgent local escalation risk rather than an actively exploited threat.
Local privilege escalation in the Windows Device Association Service (DAS) allows an already-authenticated low-privileged user to raise their rights on the host by winning a timing-dependent race condition in the service's handling of a shared resource. Exploitation is local-only with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0), so it is a genuine but moderate-priority elevation-of-privilege issue rather than an urgent remote threat; there is no public exploit identified at time of analysis. Exposure is concentrated on multi-user hosts such as RDP/terminal servers, shared build and CI agents, and shared workstations, and is minimal on single-user endpoints where no untrusted local account exists; Microsoft has released patches via its update guide.
Remote code execution in Windows DNS Server affects Windows Server 2012 through 2025 and supported Windows 10 and Windows 11 builds, enabling an unauthenticated network attacker to execute arbitrary code on a system that has the DNS Server role installed and is induced to process attacker-influenced DNS data. Exploitation requires interaction on the server side (UI:R) - for example, resolving an attacker-owned domain - so machines without the DNS role or those that never resolve attacker-controlled records are at reduced risk, and no public exploit was identified at time of analysis. The root cause is an untrusted pointer dereference (CWE-822) in DNS parsing; vendor patches are available.
Local privilege escalation in the Microsoft Windows Direct Composition (DirectComposition) graphics subsystem lets an attacker who already holds a low-privileged, authenticated local session on an affected host corrupt heap memory and elevate to a higher-integrity context, with high impact to confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All enumerated Windows 10, Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 builds below the fixed build numbers are exposed, while fully patched systems are not. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); this is a genuine but not emergency-tier priority that nonetheless warrants prompt patching on multi-user, RDP-accessible and shared-workstation fleets because the component is reachable from a standard unprivileged session with no special configuration.
Local privilege escalation in the Windows Win32K graphics subsystem (GRFX component) allows an authenticated user holding only low or standard privileges to corrupt kernel pool memory and elevate to SYSTEM on affected Windows hosts. The heap-based buffer overflow (CWE-122) is reachable through the Win32K graphics code path that is active by default on every affected desktop and server build, so no special configuration or user interaction is required, but the attack is strictly local (AV:L, PR:L, UI:N), meaning it is usable only as a post-compromise escalation primitive after an attacker already has code execution on the host. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; vendor patches are available from Microsoft, making this a credible but not emergency-priority patch item, with the highest exposure on shared, multi-user and remote-session hosts where untrusted users can run code.
Local privilege escalation in the Windows Fast FAT (fastfat.sys) driver allows an authenticated attacker to corrupt kernel memory and gain SYSTEM-level code execution on the affected host. The flaw is an out-of-bounds write (CWE-787) triggered when the driver parses attacker-controlled FAT/FAT32/exFAT filesystem metadata, so exploitation in practice requires mounting or attaching a crafted volume, disk image, or removable USB device while holding valid local credentials (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0). There is no network vector and no public exploit identified at time of analysis; CISA SSVC rates exploitation as 'none' and automatable as 'no', and the high attack complexity implies a race or precise memory-grooming prerequisite that limits reliability, making this a legitimate but second-tier priority compared with remotely reachable or actively exploited Windows bugs. Microsoft has released fixes and the affected build ranges are documented for Windows 10, Windows 11, and Windows Server 2012 through 2025.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who already holds low-privileged, authenticated access on the host to gain SYSTEM-level code execution by causing the driver to process a crafted UDF-formatted volume or mountable disc image. Exploitation depends on a race condition (CWE-362) that opens a narrow use-after-free window, so an attacker must repeatedly trigger concurrent UDFS operations and success is probabilistic rather than deterministic. Microsoft has published a fix through its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A heap-based buffer overflow (CWE-122) in the Windows exFAT file system driver allows a local, authenticated low-privilege attacker to elevate privileges to kernel/SYSTEM level, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). To trigger it, the attacker must first hold an account on the host and then cause the vulnerable driver to parse attacker-controlled exFAT metadata - realistically a crafted exFAT-formatted USB device, disk image or VHD - so systems that block removable media or untrusted image mounting are materially less exposed. Affected hosts include Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1) and Windows Server 2012 through 2025 (including Server Core) at builds below the patched thresholds published in Microsoft's advisory. There is no CISA KEV listing and no public exploit identified at time of analysis, and vendor patches are available, making this a credible patch-now local privilege-escalation item rather than a remotely exploitable or actively exploited threat.
Local privilege escalation in the Windows Universal Disk Format File System (UDFS) driver allows an authenticated low-privileged user to corrupt kernel memory by making the host parse a crafted UDF volume, typically a mounted optical disc or ISO image, and thereby elevate to SYSTEM-level code execution. The defect is a use-after-free classified under CWE-122 (heap-based buffer overflow), with associated tags pointing to buffer/heap-overflow and denial-of-service (system crash) outcomes; the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local, low-privileged, no-user-interaction attack with high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has shipped patches, making this a credible but not emergency-level priority rather than an active campaign risk.
Unauthorized remote code execution in Microsoft Windows PowerShell (CVE-2026-85817) stems from the engine relying on attacker-influenced data when making a security decision (CWE-807), allowing an unauthenticated network attacker to bypass that check and execute code in the context of the affected user. Exploitation requires user interaction (UI:R per the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector) - typically the victim running an attacker-supplied script or module, or opening content that PowerShell evaluates while deciding whether to trust it - so unattended server-side compromise is not indicated. Microsoft has shipped fixes in its update guide, and no public exploit code or confirmed active exploitation was identified at time of analysis; the 8.8 base score reflects full confidentiality, integrity, and availability impact once the required user action occurs.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
Use-after-free in Microsoft's Network Policy Server (NPS) allows an unauthenticated attacker on an adjacent network to execute arbitrary code in the context of the NPS service. Only Windows hosts that have the NPS role installed and reachable as a RADIUS/authentication server are exposed - hosts without NPS enabled cannot be triggered. Practical exploitation is constrained by high attack complexity (AC:H), since reliably winning the race/heap-shaping window is difficult, and no public exploit has been identified at time of analysis; Microsoft has released vendor patches, CISA's SSVC assessment rates exploitation as none and automatable as no, and EPSS/KEV data were not provided for this CVE.
A use-after-free (CWE-416) in the Windows Telephony Server (TapiSrv) component lets an authenticated, low-privileged local attacker escalate to higher privileges on affected Windows hosts. Exploitation requires a pre-existing local account plus a winning a timing-sensitive memory-reuse race (CVSS 3.1 AV:L/AC:H/PR:L/UI:N), so this is a post-compromise escalation primitive rather than a remote entry point; no public exploit code and no confirmed active exploitation were identified at time of analysis (CISA SSVC: Exploitation = none), and CISA SSVC rates technical impact as total, but the local-access and race-condition prerequisites keep this a moderate-priority patch rather than an emergency one. Microsoft has released fixes for the affected builds, so priority should be normal-cycle patching, with elevated urgency on multi-user and session-host systems where low-privileged accounts are common.
Unauthenticated remote code execution in the Windows Routing and Remote Access Service (RRAS) allows a network attacker to run arbitrary code in the context of the RRAS service on any host where the RRAS role is installed and its listener is reachable, yielding full compromise of confidentiality, integrity and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-122 heap overflow, with an authentication-bypass component implied by the pre-auth reachability of the flaw). Exposure is severely gated by configuration rather than by exploit difficulty: RRAS is not enabled by default on Windows, so only machines acting as VPN, dial-up or routing gateways - across Windows 10/11 and Windows Server 2012 through 2025 builds older than the patched build numbers - are realistically at risk. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none alongside Automatable: yes and Technical Impact: total, and Microsoft has released fixes, so this should be treated as a high-priority patch item rather than an active emergency.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Local privilege escalation in the Windows USB Video (UVC) driver allows a low-privileged, locally authenticated user to elevate to SYSTEM by triggering an integer wraparound in the driver's size handling. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8), the attacker needs a valid account and local execution on an affected Windows 10, Windows 11, or Windows Server 2016-2025 host, plus a way to reach the UVC processing path (typically a crafted or emulated USB video device); no user interaction is required and attack complexity is low. Microsoft has released fixes, and no public exploit code or confirmed active exploitation was identified at time of analysis - this is a credible, patch-worthy elevation bug rather than a drop-everything emergency.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) allows a network attacker to corrupt memory in the NPS service and potentially execute arbitrary code on Windows Server 2012 through 2025 hosts - as well as supported Windows 10 and Windows 11 builds - where the optional NPS role is installed and reachable. The defect is a stack-based buffer overflow (CWE-121) driven by an integer underflow or wraparound in packet handling, and it carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or unusual complexity are required. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), so the practical risk is concentrated in environments that actually run and network-expose the NPS role rather than on every Windows host.
Local privilege escalation in the Windows Win32 kernel subsystem (use-after-free, CWE-416) allows an authenticated low-privileged local user to gain elevated privileges, up to SYSTEM, on unpatched Windows 10, Windows 11, and Windows Server builds. The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already hold a local foothold and successfully win a timing-dependent kernel memory-reuse race, making exploitation possible but not reliably reproducible; no public exploit identified at time of analysis and no CISA KEV active-exploitation confirmation. Microsoft has released vendor patches, with affected builds enumerated in EUVD-2026-99513 below their respective fixed version numbers.
Local privilege escalation in Microsoft Windows Error Reporting (WER) lets an attacker who already holds standard-user code execution on a host trigger a heap-based buffer overflow and elevate to a more privileged context such as SYSTEM. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms this is strictly a local privilege-escalation primitive: it requires prior local access and low-level privileges, needs no user interaction, and is only useful as a post-compromise escalation step rather than a remote entry point. All supported Windows branches are affected, including Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 with Server Core installations; no public exploit has been identified at time of analysis (SSVC exploitation: none), and Microsoft has released fixes.