Windows 10 1607
Monthly
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows a remote unauthenticated attacker to crash the service over a network, resulting in denial of service for all DHCP-dependent clients on the affected segment. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 1607 and 1809, and reflects Microsoft's own reporting (secure@microsoft.com). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack surface and widespread deployment of Windows DHCP in enterprise environments elevate operational impact.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.
Unauthenticated remote code execution is possible in Microsoft's Network Policy Server (NPS), the RADIUS/NAC/802.1X role on Windows Server, through a use-after-free memory corruption flaw (CWE-416). Only hosts with the NPS role installed and reachable over the network are exposed - systems that do not run NPS, including typical Windows 10/11 clients, are not attackable through this component. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, 8.1) indicates no authentication or user interaction is required, but the high attack-complexity rating reflects that a successful exploit likely depends on winning a race or arranging a precise heap state, making it probabilistic and probably requiring repeated attempts; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a high-priority but not emergency-level item.
Heap-based buffer overflow in Microsoft's Windows Distributed File System (DFS) lets an attacker who already holds high privileges on the target send crafted network traffic to the DFS service and achieve code execution, with high impact to confidentiality, integrity, and availability. The flaw, tracked as CWE-122, affects a broad set of Windows client and server releases-including Windows 10, Windows 11 23H2/24H2/25H2/26H1/26H2, Windows Server 2012 through 2025-and carries a CVSS of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is reliable but gated behind a significant privilege prerequisite. There is confirmed no active exploitation per SSVC (Exploitation: none) and no public exploit identified at time of analysis; CISA's SSVC also rates it non-automatable, so mass scanning and worm-style spread are not expected. The practical risk is concentrated in environments where the DFS role is deployed and network-reachable and where an attacker has already obtained administrative-equivalent access, making this a post-compromise elevation/impact vector rather than an initial access path.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
Local privilege escalation in Microsoft Windows Installer (msiexec) lets an attacker who already holds low-privilege authenticated access on an affected Windows host corrupt memory in the installer code path and elevate to SYSTEM (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying defect is a numeric-truncation/stack-based buffer overflow (CWE-121) in MSI handling that requires no user interaction and is reliable once a local foothold exists, but it is not remotely reachable. No public exploit code has been identified and CISA's SSVC assessment records no exploitation activity, so this is a credible but not urgent patch-cycle priority rather than an actively exploited threat; Microsoft has released fixes via its MSRC update guide.
Local privilege escalation in the Windows Text Services Framework (TSF) allows an attacker who already holds a low-privileged foothold on a Windows host to raise their privileges to SYSTEM by triggering a use-after-free (CWE-416) in the text-input subsystem, scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the patched revision levels are affected, with the greatest exposure on multi-user, RDP, and terminal-server hosts where low-privileged sessions and higher-integrity processes coexist. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) affects Windows 10 and Windows 11 builds from 1607 through 26H1/26H2 as well as Windows Server 2012 through 2025, including Server Core installations, but only on hosts where the RRAS role is actually installed and enabled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates an unauthenticated, remotely reachable attacker who requires neither credentials nor user interaction can corrupt memory in the service and gain full impact to confidentiality, integrity, and availability. Because RRAS is not a default role, exposure is limited to systems deployed as VPN, dial-up, NAT, or LAN/WAN routing gateways; a vendor patch is available and no public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
Local privilege escalation in the Windows CD-ROM Driver (cdrom.sys) lets an authenticated, low-privileged user already logged on to a vulnerable host trigger a type-confusion condition and elevate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N). Exploitation requires prior local access and the ability to cause the driver to process crafted optical-media or disc-image content, so multi-user, terminal-server, and shared-workstation deployments carry the greatest realistic exposure. Microsoft has published a vendor fix through the MSRC update guide, and no public exploit code was identified at time of analysis; the affected base spans Windows 10, Windows 11, and Windows Server 2012 through 2025 builds below the fixed levels listed in EUVD-2026-99501.
Local privilege escalation in the Windows Print Spooler service allows an authenticated low-privilege attacker to gain full control of an affected host by abusing weak authentication logic (CWE-1390). The flaw is confined to unpatched builds across Windows 10, Windows 11, and Windows Server 2012 through 2025, and requires a prior local foothold because the vector is AV:L/PR:L with no user interaction; SSVC rates it non-automatable, no public exploit has been identified, and no active exploitation is confirmed (CISA KEV not applicable). Treat it as a genuine but non-urgent patching priority, since successful exploitation yields total technical impact (C:H/I:H/A:H) once the prerequisite access exists.
Local privilege escalation in the Windows Universal Plug and Play (UPnP) Device Host service allows an attacker who already holds a low-privileged foothold on a Windows host to elevate to SYSTEM by triggering a use-after-free in the service's memory handling. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning it is local and requires an authenticated standard user, but needs no user interaction and yields full confidentiality, integrity, and availability impact; CISA's SSVC assessment records Exploitation: none and Automatable: no, consistent with a race-dependent memory-reuse bug rather than a reliably repeatable exploit. It affects a broad set of supported Windows client and server editions whose UPnP Device Host service is enabled by default, and vendor patches are available; no public exploit code has been identified at time of analysis, so this is a post-compromise escalation primitive rather than a remote or opportunistic threat.
Local privilege escalation in the Windows UPnP Device Host service allows an authenticated low-privileged user to execute code with elevated rights by triggering a heap-based buffer overflow (CWE-122), rated CVSS 7.8. Exploitation requires an existing local foothold (AV:L, PR:L) and the UPnP Device Host service to be running and reachable; no user interaction is needed (UI:N), and there is no remote vector. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Kernel allows an attacker who already holds low-privileged code execution on a host to raise their privileges - potentially to SYSTEM - by triggering a use-after-free (CWE-416) in kernel memory handling. Exploitation depends on two conditions that keep risk moderate: the attacker must first obtain local, authenticated access (AV:L/PR:L, with no network-reachable vector), and they must win a non-deterministic free-then-reuse race window (AC:H), which CISA's SSVC assessment reflects as Automatable: no. No public exploit has been identified at time of analysis, and exploitation status is recorded as none; Microsoft has released vendor patches covering all supported Windows client and server branches.
Unauthenticated remote code execution in Microsoft's Network Policy Server (NPS) role - the RADIUS server bundled with Windows Server - stems from a use-after-free memory corruption bug (CWE-416) that a network attacker can trigger to run code in the context of the NPS service. Only hosts that actually have the NPS role installed and reachable are exposed, since the role is not enabled on a default Windows installation; the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) confirms no privileges or user interaction are needed but the high attack-complexity metric reflects a memory-state race that must be reliably triggered, and CISA's SSVC assessment rates the issue non-automatable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Microsoft has shipped fixes; per the EUVD data, patched builds include 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), with corresponding builds for the Windows 11 and Windows Server 2025 branches.
Heap-based buffer overflow in the Windows Servicing Stack (SSU) allows an authenticated, locally logged-on attacker with only low privileges to corrupt heap memory and elevate privileges on affected Windows hosts. Exploitation is constrained by high attack complexity (AC:H per CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning success depends on conditions the attacker does not fully control - consistent with a timing- or heap-layout-sensitive trigger - and it is not remotely reachable and requires no user interaction. Microsoft has published fixed builds for every affected Windows edition via its update guide, and no public exploit identified at time of analysis; CISA's SSVC assessment records Exploitation: none, Automatable: no, with Technical Impact: total, so this is a genuine but moderate-priority local elevation-of-privilege issue rather than an emergency mass-exploitation event.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Local privilege escalation in Microsoft Windows Performance Monitor lets an attacker who already holds a valid low-privileged local account repeatedly invoke the component, win a non-deterministic race condition on a shared resource, and escalate to higher privileges with high confidentiality, integrity and availability impact. Affected platforms per the CPE and EUVD data span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2) and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations. Exploitation is constrained by local-only access and high attack complexity (CISA SSVC rates it non-automatable and no public exploit was identified at time of analysis); EPSS is low at 0.25% (15th percentile) and the flaw is not in CISA KEV, making this a genuine but moderate-priority local privilege escalation with a vendor patch available.
Local privilege escalation in the Microsoft Account component shipped with default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an attacker who already holds low-privileged local access to a host win a race condition and gain high-integrity code execution as SYSTEM. The flaw is a race condition (CWE-362) in which Microsoft Account code accesses a shared resource without proper synchronization; per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) it is not remotely reachable, requires authenticated local access at PR:L, needs no user interaction, but is gated by high attack complexity because reliable exploitation depends on precise timing and typically many repeated attempts. There is no confirmed active exploitation and no public exploit identified at time of analysis, SSVC rates Automatable: no with total technical impact if the race is won, and vendor patches are available in the Microsoft security updates referenced by the MSRC advisory.
Local privilege escalation in the Windows Print Spooler allows a low-privileged, already-authenticated user to corrupt heap memory and gain elevated (SYSTEM-level) code execution on the affected host. The flaw is a heap-based buffer overflow (CWE-122) reachable only with a pre-existing local foothold and standard-user rights (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8); it is not remotely or unauthenticated-exploitable, and no user interaction is required once local access exists. At time of analysis there is no public exploit identified and CISA's SSVC assessment records no observed exploitation, though technical impact is rated total given the full confidentiality, integrity, and availability loss on the target; vendor patches are available, which keeps this a genuine but second-tier priority relative to remotely exploitable spooler defects.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Memory corruption in the Windows DNS Server role allows an authorized, low-privileged attacker who can reach the DNS service over the network to execute arbitrary code in the context of the DNS service. The flaw is a release of an invalid pointer or reference (CWE-763) rated CVSS 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning no user interaction, low attack complexity, net-unauthenticated reachability but a low-privilege prerequisite (PR:L) matching Microsoft's 'authorized attacker' wording. Exposure is limited to hosts that actually run the DNS Server role - Windows Server 2012 through 2025 (including Server Core installations) and Windows 10/11 builds with the role enabled - and at the time of analysis there is no public exploit code identified and CISA's SSVC assessment records exploitation as 'none', so this is a high-priority hardening item for DNS-hosting infrastructure rather than an emergency drop-everything event. Vendor patches are available, and the underlying build-level fixes are enumerated in the affected-version data below.
Remote code execution in the Windows DNS Server role is achievable by an unauthenticated, network-positioned attacker who can send crafted DNS traffic to an affected host, as described by an integer underflow (CWE-191) defect in how the service handles attacker-influenced input. Per the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) exploitation is remote, low-complexity, requires no credentials and no user interaction, and yields total loss of confidentiality, integrity and availability on the DNS server - the practical limit being that only Windows systems actually running the DNS Server role (Windows Server 2012 through 2025, plus Windows 10/11 builds where the role is installed) are exposed. Microsoft has released vendor patches through the MSRC update guide and the EUVD advisory maps fixed builds per platform; there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data. CISA's SSVC assessment records Exploitation: none, Automatable: yes, Technical Impact: total, which supports treating this as a genuine high-priority patching item rather than a high-score-but-low-real-risk case.
Type confusion in the Windows DNS Server role enables unauthenticated remote attackers to execute arbitrary code on affected systems, but exploitation requires user interaction (UI:R) - the DNS server must be induced to process a maliciously crafted record or response. Affected builds include Windows Server 2012 through Server 2025 and Windows 10/11 client installations prior to the patched build numbers listed in Microsoft’s advisory. Microsoft has released patches, and no public exploit or active exploitation has been identified at the time of analysis (SSVC exploitation: none).
A memory-leak flaw (CWE-401) in the Microsoft Windows DNS Server service lets an unauthenticated, remote attacker gradually exhaust server memory by sending repeated DNS queries, ultimately degrading or denying DNS resolution on affected hosts. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H), no credentials or user interaction are required, and any default DNS-server deployment reachable on the network is exposed; however, this is a slow resource-exhaustion condition rather than an instantaneous crash, so the practical impact scales with sustained traffic and available memory. An independent assessment rates this as a genuine but second-tier priority: SSVC indicates no known exploitation, no publicly available exploit code has been identified at time of analysis, and a vendor patch is available, making timely patching the decisive control.
Unauthenticated remote code execution in the Windows DNS Server role stems from a use-after-free (CWE-416) that lets an attacker who can reach the service over the network run code in the context of the DNS service. All supported Windows Server generations carrying the DNS role are affected - 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), plus Windows 10 1607 and 1809 where the role is installed - while hosts without the DNS Server role are not exposed. The practical risk is tempered by high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), since reliable exploitation depends on winning a race or landing a specific heap state; no public exploit identified at time of analysis, CISA SSVC records Exploitation: none and Automatable: no, and a vendor-released patch is available - making this serious but not emergency-tier.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Remote code execution in the Microsoft Windows iSCSI Initiator component (reported against Windows releases carrying the affected MSiSCSI/iSCSI code path) allows an unauthenticated, remote attacker to corrupt heap memory and execute arbitrary code in the context of the iSCSI service by driving a crafted iSCSI protocol exchange against the target. The flaw is a memory-safety defect (reported as a use-after-free, with vendor metadata also flagging buffer/heap overflow and denial-of-service characteristics) reachable from CVSS vector AV:N/AC:H/PR:N/UI:N, so no credentials or user interaction are needed and impact is scored C:H/I:H/A:H - full confidentiality, integrity and availability loss on the host. Exploitation is gated by prerequisites rather than by authentication: the victim host must have the iSCSI Initiator running and must establish a session with an attacker-controlled or spoofed iSCSI target, and the AC:H rating reflects a race/timing condition (or protocol state dependency) the attacker must win reliably. No public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis, so this should be prioritized on exposure and asset criticality rather than on observed in-the-wild activity.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Local code execution and information disclosure on patched-but-not-updated Windows hosts can result from an out-of-bounds read in the Windows Overlay Filter (WOF), a kernel-mode filesystem filter driver that services compressed and overlay file operations. Affected are Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025 in both full and Server Core installations below the builds listed in the vendor update matrix. Exploitation requires a pre-existing local, authenticated foothold with at least low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) - remote, unauthenticated attack is not possible - and no public exploit code has been identified at time of analysis, with SSVC recording Exploitation=none and Automatable=no, placing this in the post-compromise privilege-escalation and information-leak class rather than a wormable emergency. A vendor patch is available and should be applied through the standard Microsoft monthly servicing channel.
Elevation of privilege in the Windows Overlay Filter (WOF) driver allows an attacker who already holds a low-privileged local foothold on a supported Windows host to run code at SYSTEM level by triggering an integer overflow/wraparound during a filter operation. Exploitation is local-only and requires authenticated code execution at low privilege (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) with no user interaction; CISA's SSVC assessment records Exploitation=none and Automatable=no, so there is no public exploit identified at time of analysis. Vendor patches exist for every affected SKU, which materially lowers residual risk for organizations that have applied current servicing updates.
Local privilege escalation in the Microsoft Windows Overlay Filter (WOF) affects default installations of Windows 10, Windows 11, and Windows Server 2012 through 2025 that have not yet applied the fixed builds listed in the EUVD advisory. An attacker who already holds a low-privileged, authenticated local session (CVSS vector PR:L, AV:L) can trigger a buffer over-read in the filter - tracked as CWE-126 - and, on success, gain high confidentiality, integrity, and availability impact as reported by the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score of 7.8. No user interaction is required and there is no remote or network attack vector; exploitation status is neutral (SSVC: Exploitation none, Automatable no), with no public exploit identified at time of analysis. This is a genuine but second-tier priority: the vendor has shipped patches, and the flaw is only reachable from an already-compromised local user context.
Out-of-bounds read in the Windows Overlay Filter (wof.sys), a kernel-mode Windows component enabled by default, allows an authenticated local attacker with an existing low-privileged foothold to elevate privileges on the host (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because wof.sys loads by default across supported client and server editions, no non-default configuration is required to reach the vulnerable code; the primary gating factor is the prerequisite of local code execution, and no public exploit has been identified at time of analysis, with CISA SSVC rating exploitation as none and the attack as not automatable. Successful exploitation yields total technical impact per SSVC (high confidentiality, integrity and availability impact), consistent with a kernel-level memory-safety primitive being turned into local privilege escalation.
Local privilege escalation in the Windows Overlay Filter (WOF) driver lets an attacker who already holds low-privileged, authenticated local access on an affected Windows host trigger a buffer over-read (CWE-126) that can be leveraged to gain elevated privileges, with high confidentiality, integrity and availability impact, matching the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is not remotely reachable and cannot be used for initial compromise because it requires an existing foothold on the machine, and CISA's SSVC assessment records no observed exploitation while no public exploit has been identified at time of analysis. Microsoft has shipped vendor patches covering the affected Windows 10, Windows 11 and Windows Server 2012 through 2025 builds, so this is best treated as a credible patch-cycle priority rather than an emergency.
Local privilege escalation in the Windows Client for NFS affects systems where the optional Client for NFS feature has been installed, allowing an attacker who already holds authenticated low-privileged local access to trigger a heap-based buffer overflow (CWE-122) and gain full control of the host at the kernel/SYSTEM level. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, requires low privileges, needs no user interaction, and is confined to the affected machine - a technically complete compromise but not a remotely reachable or self-propagating one. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, and the vendor has released patched builds, so this is best treated as a genuine but second-tier local privilege-escalation issue whose real-world exposure is gated by whether the NFS client component is present.
Heap-based buffer overflow in Windows Core Messaging lets an authenticated local attacker with low-level privileges corrupt heap memory and elevate to a higher-integrity context on affected Windows systems (CVSS 3.1 base score 7.8). Because the vector is AV:L/PR:L/UI:N and the SSVC decision framework records Exploitation: none and Automatable: no, this is a second-stage, post-foothold privilege-escalation issue rather than a remotely reachable entry point, and no public exploit code was identified at time of analysis. Exploitation risk is currently low (EPSS 0.36%, 28th percentile) and it is not confirmed actively exploited (no CISA KEV listing), but vendor patches are available and technical impact is rated total, so it remains a credible moderate-priority item for patching and least-privilege hardening.
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
Remote code execution is possible in the default Windows TCP/IP networking stack across a broad range of supported Windows client and server releases, caused by a use-after-free (CWE-416) in packet processing that an unauthenticated remote attacker can trigger by sending specially crafted network traffic. The flaw is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack-complexity and race-condition nature of the memory-reuse window being the primary limiting factor - reliable code execution requires precise timing and memory-state control, though a successful exploit gives full compromise of confidentiality, integrity, and availability on the target host, and failed attempts may still crash the stack. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as "none"; vendor patches (Microsoft security updates) are available, making this a serious-but-not-emergency issue that should be prioritized within a normal Patch Tuesday cycle rather than treated as an emergency zero-day response.
Heap-based buffer overflow in Microsoft COM for Windows allows an authenticated local attacker to elevate privileges on an affected system. Exploitation requires pre-existing local, low-privileged access (CVSS PR:L, AV:L); no user interaction is needed and attack complexity is low, so once a foothold exists the overflow is reliably reachable against default Windows installations where COM is always present. The flaw yields full confidentiality, integrity and availability impact on the host, making it a post-compromise privilege-escalation primitive rather than a remote entry point; a vendor patch is available, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow in the Windows Imaging Component (WIC) - Microsoft's image-decoding framework used across Windows 10, Windows 11, and Windows Server 2012 through 2025 - lets remote, unauthenticated attackers execute arbitrary code by getting a malformed image to reach a WIC decoder. Per our independent assessment the attack is network-reachable and needs no credentials (CVSS PR:N), but practical exploitation requires the victim to parse attacker-supplied image data delivered via a web page, email, document, or shared file, and the vendor's own vector rates it UI:N while our assessed vector reflects UI:R given the need to trigger decoding of the crafted image. Heap-overflow exploitation on hardened Windows builds also requires defeating ASLR and heap mitigations, which can raise real-world complexity above the AC:L rating. A vendor patch is available (Microsoft MSRC update guide) and no public exploit code has been identified at time of analysis; CISA SSVC records exploitation as 'none' with total technical impact and 'automatable: yes', so this should be treated as a high-priority patch-now issue even without evidence of active use.
Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds.
Use-after-free (CWE-416) in the Windows Kernel enables a low-privileged local attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates full confidentiality, integrity, and availability compromise once triggered, though the high attack complexity (AC:H) implies a race-condition or specific timing requirement that raises the bar for reliable exploitation. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Key Distribution Center (KDC) allows unauthenticated network attackers to crash the Kerberos authentication service by sending a specially crafted packet to port 88, resulting in a denial of service condition. The vulnerability spans the entire supported Windows Server portfolio from Server 2012 through Server 2025, as well as Windows 10 and 11 client builds, confirmed by EUVD-2026-73363. No public exploit code has been identified at time of analysis; however, the unauthenticated, low-complexity network attack surface makes this a high-priority patch for organizations running Active Directory, where KDC availability is a single point of failure for domain-wide Kerberos authentication.
Heap-based buffer overflow in the Microsoft Windows Graphics Component enables a locally authenticated attacker to achieve arbitrary code execution with full confidentiality, integrity, and availability impact (C:H/I:H/A:H) across a remarkably broad swath of Windows versions, spanning Server 2012 through Windows 11 26H1. The vulnerability (CWE-122) is reachable by any standard user account (PR:L) with no user interaction required, making it a reliable local privilege-escalation primitive for post-compromise attack chains. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. Microsoft has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the vulnerability is not in the CISA KEV catalog.
Heap-based buffer overflow in Windows Error Reporting (WER) allows a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows endpoints and servers. The CVSS scope change flag (S:C) indicates the exploit escapes the attacker's process boundary, achieving full C:H/I:H/A:H impact on the broader system. Patch is available from Microsoft as part of a Patch Tuesday update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in Windows NTFS (ntfs.sys) allows a low-privileged local attacker to achieve SYSTEM-level code execution via a heap-based buffer overflow (CWE-122). The vulnerability spans virtually every supported Windows release - from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025 - making the affected surface exceptionally broad. No public exploit code has been identified at time of analysis, but LPE primitives in the kernel NTFS driver are a high-value post-exploitation capability routinely sought by ransomware operators and APT groups following initial access.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables remote code execution across a wide range of Microsoft Windows desktop and server editions. Exploitation requires a user to open or preview a maliciously crafted image file - consistent with the UI:R CVSS metric - which triggers CWE-122 heap corruption that can be leveraged for arbitrary code execution with full confidentiality, integrity, and availability impact. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all current servicing branches; Microsoft has issued patches for all affected release lines, and no public exploit or CISA KEV entry has been identified at time of analysis.
Out-of-bounds read in the Windows Services for NFS ONCRPC XDR Driver enables unauthenticated remote attackers to crash the affected Windows system, causing a denial-of-service condition. The flaw resides in the kernel-mode driver that processes ONC RPC (Open Network Computing Remote Procedure Call) External Data Representation (XDR) packets, meaning a specially crafted network request can trigger a memory read beyond intended buffer boundaries - most likely a kernel panic (Blue Screen of Death). The affected surface spans Windows 10, Windows 11, and Windows Server versions from 2012 through 2025; a vendor patch is available via Microsoft's update guide. No public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) enables a locally authenticated low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, making it one of the broadest-scope local privilege escalation issues in the current patch cycle. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV active exploitation entry has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables a local attacker with low-privilege code execution to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires no user interaction and no elevated starting privileges beyond a standard user session. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions via the update guide at msrc.microsoft.com.
Local privilege escalation via heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WBioSrvc) affects Windows 10, Windows 11, and Windows Server 2016 through 2025 across a broad range of build versions. An authorized local attacker with low privileges can trigger the overflow to corrupt heap memory and achieve SYSTEM-level access, yielding full confidentiality, integrity, and availability impact on the local machine. Microsoft has released patches through the standard Patch Tuesday cycle; no active exploitation or public proof-of-concept has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBio) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access across a broad swath of Windows 10, Windows 11, and Windows Server editions. The vulnerability is rooted in CWE-122 (heap buffer overflow) within the service that manages biometric devices such as fingerprint readers and Windows Hello. Microsoft has released patches via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables any authenticated local user to elevate privileges to SYSTEM across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation conditions - no complex setup or user interaction required - with full confidentiality, integrity, and availability impact on the host. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service (WbioSrvc) affects every major Windows desktop and server release from Windows 10 1607 through Windows 11 26H1. An authenticated local user with standard (low-privilege) access can trigger a heap-based buffer overflow in the biometric service process, elevating execution to SYSTEM level and achieving full C:H/I:H/A:H compromise of the host. Microsoft has released patched builds across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the enormous footprint of affected Windows versions across both workstation and server estates makes this a high-urgency patch candidate.
Local privilege escalation in Windows Biometric Service (WBioSrvc) allows a low-privileged authenticated local user to achieve full system compromise through a heap-based buffer overflow. The flaw affects a wide range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025), making it broadly relevant across enterprise environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a meaningful post-exploitation stepping stone.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM without user interaction. The flaw spans virtually every supported Windows release - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows Biometric Service via use-after-free (CWE-416) allows a low-privileged, locally authenticated attacker to gain SYSTEM-level access across a broad range of Windows client and server releases. The vulnerability spans Windows 10 through Windows 11 (multiple feature releases) and Windows Server 2016 through 2025, placing it among the widest-footprint Microsoft patch-Tuesday EoP issues. Microsoft has released fixed builds; no public exploit identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privilege attacker to escalate to full SYSTEM-level privileges across fifteen distinct Windows 10, Windows 11, and Windows Server build configurations. The flaw (CWE-122) resides in the service's heap memory management and, given the CVSS AC:L rating, is considered straightforward to exploit once local or RDP access is established. Vendor-released patches are available for all affected build lines; no public exploit code and no CISA KEV listing have been identified at the time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WinBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server releases. The flaw (CWE-122) exists in a high-privilege Windows service, making it a reliable local privilege escalation primitive for post-exploitation scenarios. No public exploit identified at time of analysis, and no CISA KEV listing; Microsoft has released patches across all affected version branches.
Heap-based buffer overflow in the Windows Biometric Service (WBioSrvc) allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM level on affected endpoints and servers. The flaw (CWE-122) spans 15 distinct Windows builds from Windows 10 1607 through Windows Server 2025, making it broadly applicable across most enterprise Windows fleets. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows client and server platforms. An authenticated low-privileged user can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide version footprint across Windows 10 through Windows 11 and Server 2016-2025 makes this a significant enterprise patching priority.
Heap-based buffer overflow in Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on Windows 10, Windows 11, and Windows Server 2016 through 2025. An attacker with a standard local user account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches covering all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms low-complexity local exploitation with full confidentiality, integrity, and availability impact, consistent with a service-level privilege escalation. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via Microsoft's July 2026 security update.
Heap-based buffer overflow in the Windows Biometric Framework Service enables an authenticated local attacker to escalate privileges to SYSTEM level across a broad range of Windows 10, Windows 11, and Windows Server versions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the flaw is straightforward to trigger with only a low-privileged local account and no user interaction, making it an effective post-compromise escalation primitive. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches for all affected builds.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a low-privileged local attacker to escalate to SYSTEM-level privileges across a broad range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) requires only a valid local account and no user interaction, making it a reliable post-exploitation stepping stone for attackers who have already obtained initial access. Microsoft has released patches across all affected build branches; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows 10, Windows 11, and Windows Server releases. Exploitation requires an authorized, low-privileged local account, after which the attacker achieves full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables local privilege escalation to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server editions. An authorized attacker with low-privilege code execution can corrupt heap memory within the biometric service process to achieve full C:H/I:H/A:H impact without any user interaction. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Local privilege escalation in Windows Biometric Service affects a broad sweep of Windows 10, Windows 11, and Windows Server versions through a use-after-free memory corruption condition. An authorized local attacker with standard (low-privilege) credentials can exploit the UAF to elevate to SYSTEM-level access, achieving full confidentiality, integrity, and availability impact on the host. No public exploit or active exploitation has been identified at time of analysis, but the extensive Windows footprint and confirmed vendor patch make timely deployment a clear priority.
Heap-based buffer overflow in the Windows Biometric Service (wbiosrvc) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on a wide range of Windows desktop and server releases, from Windows 10 Version 1607 and Server 2016 through Windows 11 Version 26H1 and Server 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only a standard user session with no user interaction and no special complexity, making this a reliable post-exploitation LPE primitive. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Windows Biometric Service (WBioSrvc) enables a locally authenticated, low-privileged user to escalate to SYSTEM-level privileges on a wide range of Windows 10, Windows 11, and Windows Server 2016-2025 builds. Microsoft has confirmed the issue and released patched builds via Windows Update. No public exploit code or CISA KEV listing exists at time of analysis, but the LPE utility of this class of vulnerability makes it a standard element in post-initial-access attack chains and a meaningful enterprise patch priority.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a locally authenticated low-privileged attacker to achieve SYSTEM-level privilege escalation on any unpatched supported Windows endpoint or server. The vulnerability exists in a default-enabled service present across all supported Windows 10, Windows 11, and Windows Server 2016-2025 builds, making the affected surface essentially every managed Windows environment. No public exploit or CISA KEV listing has been identified at time of analysis; however, AC:L indicates straightforward exploitation once triggered, making this a high-priority patch target given its ubiquitous footprint and value as a post-exploitation escalation primitive.
Local privilege escalation in the Windows Device Association Service allows an authenticated local attacker to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability spans virtually all supported Windows desktop and server releases - from Windows 10 version 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. The high complexity (AC:H) rating indicates a race-condition-dependent exploitation path, and no public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all affected builds.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) miniport driver (vhdmp.sys) allows an attacker who already holds local, low-privileged access on an affected Windows 10, Windows 11, or Windows Server build to corrupt kernel heap memory and potentially execute code in kernel context by triggering driver processing of a mounted VHD/VHDX virtual disk. The issue is rated 7.8 and was addressed by Microsoft as a kernel elevation-of-privilege fix; there is no public exploit identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.21% (12th percentile), indicating limited near-term exploitation likelihood. Independent assessment scores AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, so this is a genuine but not high-urgency priority: exploitation requires pre-existing authenticated local access plus heap grooming to overcome high attack complexity, but the technical impact is total because success yields kernel-level control of the host.
Privilege escalation via out-of-bounds read in Windows Remote Desktop Services affects authenticated low-privileged users across a broad range of Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. An attacker holding valid low-privileged credentials can exploit the CWE-125 memory flaw over the network to achieve full system compromise, with the vendor-assessed impact reaching C:H/I:H/A:H. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected build lines.
Use-after-free (CWE-416) in the Windows DNS service enables unauthenticated remote attackers to crash the DNS server, causing a denial-of-service condition across affected Windows Server and Windows 10 deployments. The vulnerability exists in DNS server processing logic where memory is freed and subsequently accessed, corrupting heap state and triggering a service crash. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation as 'none' and technical impact as 'partial', consistent with a DoS-only scenario.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Privilege escalation in the Windows Biometric Service (WBS) allows a locally authenticated user to gain SYSTEM-level access by triggering a heap-based buffer overflow in the service process. The flaw spans all currently supported Windows 10, Windows 11, and Windows Server releases from 2016 through 2025, making the attack surface extremely broad. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available via the July 2026 Patch Tuesday cycle.
Privilege escalation to SYSTEM in Windows Biometric Service via heap-based buffer overflow (CWE-122) affects every supported Windows client and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. A low-privileged local authenticated attacker can exploit the flaw with no user interaction required (CVSS AV:L/AC:L/PR:L/UI:N) to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis; patch availability is confirmed via Microsoft MSRC.
A use-after-free (CWE-416) in the Microsoft Windows Distributed File System (DFS) service lets an attacker who already holds low-privilege authorized access and can reach DFS over the network crash or destabilize the service, producing a denial-of-service condition on the affected host. Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2012 through 2025 are in scope, and the attack surface only exists where DFS is enabled or in use. Exploitation is limited by the high attack complexity of the underlying memory-reuse race, no public exploit code has been identified at time of analysis, and EPSS is low at 0.61% (47th percentile), so this is a moderate-priority patch rather than an emergency. Vendor-released patches are available through Microsoft's update guide.
Local privilege escalation in Windows Management Instrumentation (WMI) via a use-after-free memory corruption flaw enables any low-privileged local account holder to gain full system compromise (C:H/I:H/A:H) across a sweeping range of Windows client and server versions from Server 2012 through Windows 11 26H1. The CVSS AC:H rating reflects the heap-grooming and race-condition complexity inherent in reliable UAF exploitation. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected product lines through the MSRC advisory process.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver (volmgrx-class kernel component) allows a local, low-privilege authenticated attacker to escalate privileges to SYSTEM. The vulnerability affects a sweeping range of Windows client and server releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable across enterprise environments. No public exploit has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows a remote unauthenticated attacker to crash the service over a network, resulting in denial of service for all DHCP-dependent clients on the affected segment. The vulnerability spans a wide range of Windows Server versions from 2012 through 2025, as well as Windows 10 1607 and 1809, and reflects Microsoft's own reporting (secure@microsoft.com). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack surface and widespread deployment of Windows DHCP in enterprise environments elevate operational impact.
Local privilege escalation in Windows Installer (msiexec) affects every major Windows release from Server 2012 through Windows 11 26H1 and Server 2025, allowing a low-privileged authenticated attacker to achieve full SYSTEM-level control by winning a race condition against the installer's SYSTEM-context file operations. The vulnerability (CWE-362) requires high attack complexity due to the inherent timing constraints of race window exploitation, but no user interaction is needed once local code execution is established. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service enables an unauthenticated remote attacker to crash the service by sending a crafted network packet, resulting in denial of DHCP service to all network clients. All actively supported Windows Server releases from 2012 through 2025 are affected, as is Windows 10 versions 1607 and 1809 with the DHCP Server role installed. Microsoft has released patches for all affected versions; no public exploit or CISA KEV listing is identified at time of analysis.
Unauthenticated remote denial-of-service in the Windows DHCP Server service across a broad range of Windows Server builds (2012 through 2025) stems from a type confusion flaw (CWE-843) in packet-processing logic. A network-adjacent or remote attacker can send a malformed DHCP packet that causes the server process to access a resource using an incompatible type, crashing the DHCP service and halting IP address assignment for all dependent clients. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but the zero-authentication requirement and broad version footprint make this a practical target.