Windows 10 1809
Monthly
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Remote unauthenticated denial of service in Windows Network File System (NFS) allows a network attacker to crash the NFS service by sending a malformed packet that triggers a buffer over-read (CWE-126). Affected systems span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog; Microsoft has released patches across all affected build lines.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Windows iSCSI Target Service across multiple Windows Server and Windows 10 versions contains a null pointer dereference that enables an unauthenticated remote attacker to crash the service, resulting in denial of service. Affected systems span Windows Server 2016 through 2025 and Windows 10 versions 1607 and 1809, all below their respective patched build numbers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated network vector makes it straightforward to exploit once the target service is reachable.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.
Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a locally authenticated, low-privileged attacker to execute arbitrary code, most likely escalating to SYSTEM-level privileges. The vulnerability (CWE-122) affects an extraordinarily wide range of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11 across all current feature releases, making the aggregate exposed population very large. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; a vendor patch is available via Microsoft MSRC.
Heap-based buffer overflow in the Windows Kernel enables network-reachable remote code execution across virtually every supported Microsoft Windows release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability requires no privileges from the attacker but does require user interaction (CVSS UI:R), meaning a victim must interact with attacker-controlled content before kernel-level exploitation can proceed, yielding full compromise with high confidentiality, integrity, and availability impact. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog at time of analysis, but the extraordinary breadth of affected OS versions and the kernel-level impact class make timely patching critical.
Heap-based buffer overflow in the Windows NTFS kernel driver (ntfs.sys) allows an unprivileged local attacker to execute arbitrary code at kernel privilege level, achieving full system compromise. Nineteen distinct Windows version/build combinations are confirmed affected, spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via MSRC.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) affects a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated local attacker with low-privilege access can trigger the overflow to gain full control of the affected system, achieving confidentiality, integrity, and availability compromise at SYSTEM level. No public exploit code or KEV listing has been identified at time of analysis, but the patch is available from Microsoft and should be prioritized on workstations and servers where biometric authentication is in use.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated, low-privileged attacker to escalate to SYSTEM-level privileges across a wide range of Windows desktop and server releases. The full C:H/I:H/A:H CVSS triad indicates complete host compromise once exploited. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a wide range of Windows desktop and server platforms. The flaw (CWE-122) affects Windows 10 through Windows 11 and Windows Server 2016 through 2025, with Microsoft having released patches for all affected builds. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity rating indicates reliable exploitability for a skilled attacker who has already achieved local access.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables local privilege escalation across a wide swath of Microsoft Windows desktop and server releases. An authorized attacker holding only standard user privileges can trigger memory corruption in the biometric authentication subsystem, likely achieving SYSTEM-level code execution. The vulnerability spans Windows 10 through Windows 11 26H1 and Windows Server 2016 through Server 2025, representing virtually the entire active Windows ecosystem; a vendor-released patch is available with no public exploit identified at time of analysis.
Privilege escalation in the Windows Kernel via a numeric truncation error that leads to a heap-based buffer overflow allows a local low-privileged attacker to gain full SYSTEM-level control. The vulnerability spans virtually the entire active Windows ecosystem - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the low privilege requirement and full C/I/A impact make this a high-priority patch target for all Windows environments.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Stack-based buffer overflow in the Windows DHCP Server role enables an authenticated, adjacent-network attacker to achieve full remote code execution. Affected platforms span Windows Server 2012 through 2025 and Windows 10 (versions 1607 and 1809), covering a broad swath of enterprise infrastructure. Microsoft has released patches; no public exploit code or CISA KEV listing is identified at time of analysis.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Out-of-bounds read in the Windows DHCP Server service enables unauthenticated remote attackers to crash the service via crafted network packets, causing denial of service across any network segment served by the affected host. The flaw (CWE-125) spans Windows Server 2012 through 2025 - a thirteen-year product range - on systems where the DHCP Server role is actively installed. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Remote code execution in Windows DHCP Server results from a CWE-190 integer overflow that an unauthenticated network attacker can trigger to achieve full code execution on affected systems. The flaw spans Windows Server editions from 2012 through 2025 and select Windows 10 builds, placing a large swath of enterprise infrastructure at risk. Vendor patches are available via MSRC; no public exploit code or active exploitation has been identified at time of analysis, though the network-exposed, privilege-free attack surface warrants prompt remediation.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free memory corruption in the Windows Remote Desktop Licensing Service allows an authenticated, low-privileged network attacker to elevate privileges to a higher-privileged context. Affected systems span Windows Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected build lines.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution affects Microsoft Azure Attestation service and Device Health Attestation Service via an integer overflow condition that leads to a heap-based buffer overflow (CWE-122). Unauthenticated network attackers can exploit this flaw - confirmed by PR:N in the CVSS vector - though the high attack complexity (AC:H) indicates precise exploitation conditions must be met. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential impact is critical: full compromise of confidentiality, integrity, and availability on the affected service.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Privilege escalation via heap-based buffer overflow in the Windows DNS component affects Windows 10, Windows 11, and Windows Server editions spanning Server 2012 through Server 2025. An authorized local attacker holding low-privilege credentials can trigger the overflow to achieve full system compromise (C:H/I:H/A:H). No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center advisory.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a low-privileged local attacker to gain full system control through a use-after-free memory corruption condition. The CVSS vector (AV:L/AC:H/PR:L) confirms the attack is constrained to local access with high complexity, meaning exploitation is non-trivial and likely requires precise timing or race condition triggering. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the tags indicate Denial of Service is also a potential impact alongside privilege escalation.
Heap-based buffer overflow in the Windows DNS component enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM across a broad range of Windows releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. The CVSS 3.1 score of 7.8 reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is obtained, with no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available via the Microsoft Security Response Center.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk.
Remote unauthenticated denial of service in Windows Network File System (NFS) allows a network attacker to crash the NFS service by sending a malformed packet that triggers a buffer over-read (CWE-126). Affected systems span Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog; Microsoft has released patches across all affected build lines.
Remote code execution is possible in Microsoft Azure Attestation and the Device Health Attestation Service due to a race condition (CWE-362) in shared resource handling. An unauthenticated network attacker who can win a precise timing window can achieve full confidentiality, integrity, and availability compromise of the affected service. No public exploit code or CISA KEV listing has been identified at time of analysis, though the high-complexity nature of the flaw provides some natural exploitation barrier.
Local privilege escalation in Windows Key Guard exposes any authenticated local user to full system compromise via a heap-based buffer overflow (CWE-122). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard local user session - no elevated rights, no user interaction. This class of vulnerability is a staple post-initial-access technique in ransomware and APT intrusion chains. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.
Privilege escalation in Windows DNS affects every major Windows 10, 11, and Windows Server release from 2012 through 2025, allowing a locally authenticated low-privileged attacker to achieve full system compromise through a heap-based buffer overflow triggered by integer wraparound. The CVSS base score of 7.8 reflects total C/I/A impact and low attack complexity once local access exists. No public exploit code has been identified at time of analysis, and EPSS at 0.26% (17th percentile) confirms low current exploitation probability - though SSVC rates technical impact as total, underscoring that successful exploitation yields complete system control.
Heap-based buffer overflow in the Windows iSCSI Target Service enables an unauthenticated remote attacker to trigger denial of service across a wide range of Windows Server versions from 2012 through 2025. The vendor-assigned CVSS vector of C:H/I:H/A:H suggests potential impact beyond the description's stated denial-of-service scope, warranting attention to whether memory corruption could extend to confidentiality or integrity compromise. No public exploit or active exploitation has been identified at time of analysis; however, SSVC designates the attack as automatable, elevating the urgency for organizations running exposed iSCSI targets to apply available patches.
Remote code execution in the Windows iSCSI Target Service allows an unauthenticated network attacker to run arbitrary code by exploiting a heap-based buffer overflow (CWE-122) in the service's network-facing request handling. The flaw carries a critical 9.8 CVSS rating and is remotely reachable with no privileges or user interaction, meaning any exposed iSCSI Target endpoint can be compromised end-to-end. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in Windows Message Queuing (MSMQ) allows a locally authenticated attacker to gain SYSTEM-level privileges via a heap-based buffer overflow. Affected systems are those running Windows with the Message Queuing service enabled. The CVSS score of 7.8 (High) reflects high confidentiality, integrity, and availability impact, though exploitation requires existing local access. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution via use-after-free memory corruption in Windows DNS enables unauthenticated network attackers to achieve full system compromise against exposed DNS servers. The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network-reachable, zero-privilege exploitation, though high attack complexity signals that reliable triggering requires precise memory state manipulation rather than simple packet delivery. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Heap-based buffer overflow in the Windows Desktop Window Manager (dwm.exe) enables a locally authenticated low-privileged user to escalate to SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only existing local access with standard user credentials and no user interaction, making this a viable second-stage privilege escalation tool post-initial-compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity is a meaningful risk signal for defenders.
Privilege escalation in Windows Desktop Window Manager (DWM) allows a low-privileged local attacker to exploit a heap-based buffer overflow and obtain SYSTEM-level access. The vulnerability affects all modern Windows systems where DWM is running - its default state on any graphical Windows installation - and requires no user interaction once the attacker has local code execution. No public exploit identified at time of analysis and not listed in CISA KEV, though the low attack complexity (AC:L) meaningfully reduces the skill threshold for weaponization.
Privilege escalation in Windows Win32K via a use-after-free memory corruption flaw enables a locally authenticated standard user to gain SYSTEM-level access across a broad range of Microsoft Windows desktop and server releases. The vulnerability resides in the win32k.sys kernel-mode driver and carries a CVSS 7.8 score with low attack complexity and no user interaction required once local code execution is established. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though vendor patch is available and Win32K LPE flaws are historically attractive as second-stage payloads in chained attack campaigns.
Local privilege escalation in Windows Installer (msiexec) enables an authenticated low-privileged user to trigger a heap-based buffer overflow, potentially achieving SYSTEM-level code execution across a broad range of Windows client and server platforms spanning over a decade of releases. Affected systems include Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the exposure surface extensive across enterprise and consumer deployments. No public exploit identified at time of analysis and no active exploitation confirmed via CISA KEV; vendor-released patches are available through the Microsoft Security Response Center.
Privilege escalation in the Windows Kernel (CVE-2026-65773) enables a locally authenticated low-privileged attacker to gain full SYSTEM-level control over affected systems, with high impact on confidentiality, integrity, and availability. The flaw affects a wide swath of Windows releases - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - making the exposed surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) means a working exploit, once developed, would require minimal environmental preconditions.
Windows iSCSI Target Service across multiple Windows Server and Windows 10 versions contains a null pointer dereference that enables an unauthenticated remote attacker to crash the service, resulting in denial of service. Affected systems span Windows Server 2016 through 2025 and Windows 10 versions 1607 and 1809, all below their respective patched build numbers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low-complexity, unauthenticated network vector makes it straightforward to exploit once the target service is reachable.
Remote code execution via heap-based buffer overflow in the Windows iSCSI Target Service affects a broad range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). An unauthenticated network attacker can send a malformed iSCSI protocol request to trigger CWE-122 heap corruption and achieve arbitrary code execution on the target host. No public exploit identified at time of analysis and no CISA KEV listing, though the CVSS score of 8.1 (AC:H) reflects real exploitation complexity; the full C:H/I:H/A:H impact triad makes this a credible priority for environments running the iSCSI Target role.
Privilege escalation via use-after-free in the Windows Win32K kernel subsystem affects Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authorized local attacker with low-level authenticated access can exploit memory corruption in Win32K's kernel pool to elevate to SYSTEM-level privileges. CVSS rates this 7.0 with high attack complexity (AC:H); no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Privilege escalation via heap buffer overflow in the Windows Remote Access (RAS) API affects every major in-support Windows desktop and server release, from Server 2012 R2 through Windows 11 26H1 and Server 2025. An authenticated local attacker with low-privileged access can trigger a CWE-122 heap overflow to achieve full SYSTEM-level compromise with High confidentiality, integrity, and availability impact and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a patch across all affected build lines.
Privilege escalation in the Windows Backup Engine component affects a broad range of Microsoft Windows client and server releases, exploitable by a local authenticated user holding standard privileges. The vulnerability stems from a race condition (CWE-362) in how the Backup Engine manages shared resources under concurrent execution, creating a timing window that a low-privileged attacker can win to gain elevated - likely SYSTEM-level - access. No public exploit identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, Microsoft has issued patched builds across all affected platform branches.
Privilege escalation via heap-based buffer overflow in the Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows client and server editions spanning from Windows 10 1607 through Windows 11 26H1 and multiple Windows Server releases. An authenticated local attacker can exploit the overflow to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact on the compromised host. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV, but the vendor has released patches addressing the affected builds.
Remote code execution in Windows Deployment Services (WDS) allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on the affected server. The flaw spans virtually every supported Windows Server release (2012 through 2025) plus Windows 10 clients running the WDS role, and carries a critical CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). Microsoft has released patches; there is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low-complexity, no-auth network vector makes this a high patch priority.
Privilege escalation in the Windows Capability Access Management Service (camsvc) allows a local authenticated attacker to gain SYSTEM-level access via a use-after-free (UAF) memory corruption flaw. The vulnerability spans a wide surface including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2019, 2022, and 2025, covering both standard and Server Core installations. No public exploit code or active exploitation has been confirmed at time of analysis; however, the breadth of affected builds and the high CIA impact upon successful exploitation make patching a priority for organizations with multi-user or shared Windows environments.
Local code execution via heap-based buffer overflow in Windows GDI+ (Graphics Device Interface Plus) affects a wide range of Windows desktop and server editions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Any locally authenticated low-privilege user can trigger the overflow, gaining full control over confidentiality, integrity, and availability on the affected host. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog, but Microsoft has released patches across all affected version branches.
Remote code execution via double free (CWE-415) in the Windows Secure Socket Tunneling Protocol (SSTP) service enables a network-adjacent, unauthenticated attacker to corrupt heap memory and execute arbitrary code. The vulnerability spans virtually every supported Windows Server and Windows 10/11 release, from Server 2012 through Server 2025 and Windows 11 26H1, making the remediation footprint extremely broad. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS AC:H rating indicates exploitation requires specific race or protocol conditions rather than a trivial spray-and-pray approach.
Privilege escalation via heap-based buffer overflow in Windows Win32K (win32k.sys) allows a low-privileged local user to achieve full SYSTEM-level control across a broad range of Windows and Windows Server releases. The vulnerability spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025, making the attack surface effectively ubiquitous across enterprise environments. No public exploit identified at time of analysis, but vendor-released patches are available via the Microsoft Security Response Center.
Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.
Remote code execution in the Windows DNS component allows an unauthenticated network attacker to run arbitrary code by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Microsoft platforms from Windows 10 1607/1809 through Windows Server 2012 to Server 2025, including Server Core installations, and carries a CVSS 9.8 rating with no required privileges or user interaction. Microsoft has shipped fixes; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation via stack-based buffer overflow in the Windows Win32K kernel-mode subsystem enables a locally authenticated low-privileged user to gain SYSTEM-level access. Nineteen distinct Windows releases are confirmed affected, spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, though Win32K has historically been a favored target of APT actors and commodity malware for post-exploitation privilege escalation.
Privilege escalation via out-of-bounds read in the Windows Win32K kernel graphics subsystem affects every supported and extended-support Windows client and server release, from Windows Server 2012 through Windows 11 26H1. Any locally authenticated standard user - requiring no elevated permissions or user interaction - can exploit CWE-125 in win32k.sys to obtain SYSTEM-level privileges. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected builds across the Microsoft fleet makes this a broad patching priority regardless of active exploitation signals.
Unauthenticated code execution in Windows DHCP Server allows an attacker positioned on an adjacent network segment to trigger a heap-based buffer overflow and achieve full system compromise. The vulnerability spans a wide range of Microsoft server and desktop platforms, from Windows Server 2012 through Windows Server 2025 and select Windows 10 builds, making it broadly relevant in Windows-centric enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-interaction exploitation profile and vendor-confirmed patch availability make this a high-priority patching candidate for any organization running Windows DHCP Server.
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing to achieve full system compromise. The flaw spans Windows Server 2016 through 2025 and select Windows 10 builds, targeting the server-side DNS component; the 'Authentication Bypass' tag indicates the race window undermines an internal access control that would otherwise gate execution. Microsoft has released build-specific patches; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network vector and full C/I/A impact make this a high-priority patching target for any organization running the Windows DNS Server role.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows unauthenticated network attackers to fully compromise affected hosts across an exceptionally broad range of Windows versions, from Server 2012 through Server 2025 and Windows 10/11. The root cause is a use-after-free memory corruption flaw (CWE-416) combined with an authentication bypass, enabling an attacker to execute arbitrary code without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-exposed attack surface, zero-authentication barrier, and breadth of affected platforms make this a high-priority patching target. A vendor-released patch is available via Microsoft MSRC.