Windows 10 21h2
Monthly
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.
Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.
Information disclosure in the Windows Biometric Service exposes private personal information to locally authenticated, low-privilege attackers without requiring user interaction. The flaw, rooted in CWE-359, affects a broad swath of Windows versions from Server 2016 through Windows 11 26H1 and Server 2025, giving an authenticated local user unauthorized read access to biometric-related PII managed by the service. Microsoft has released patches across all affected version lines. No public exploit or active exploitation has been identified at time of analysis.
Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via physical USB attack affects the Windows USB Hub Driver across a wide range of Windows 10, Windows 11, and Windows Server releases. An out-of-bounds read (CWE-125) in the kernel-mode USB Hub Driver can be triggered by an attacker who plugs a crafted USB device into an exposed port, ultimately enabling full system compromise (C:H/I:H/A:H). No authentication or user interaction is required beyond physical proximity; the attack is constrained solely by the requirement of physical access to the target machine. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.
Windows Hello on a broad range of Windows 10, Windows 11, and Windows Server releases contains an uncontrolled search path element (CWE-427) that allows a locally authenticated attacker with administrative privileges to substitute a malicious component in the search path, bypassing the Windows Hello security feature and exposing confidential information. The vulnerability is strictly local and requires high privileges (CVSS PR:H, AV:L), placing it at CVSS 4.4. Vendor-released patches are available via the Microsoft Security Response Center advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.
Local integrity tampering in Windows Internet Connection Sharing (ICS) allows a low-privileged authenticated local user to invoke a critical ICS function without the required authentication, enabling unauthorized modification of network sharing configuration. The flaw stems from CWE-306 (Missing Authentication for Critical Function) and affects a broad range of Windows client and server versions from Windows 10 1607 through Windows 11 26H2 and Windows Server 2025. No public exploit code has been identified at time of analysis, and the CVSS score of 5.5 reflects the local-only attack vector and absence of confidentiality or availability impact.
Windows Task Scheduler across a broad range of Windows 10, Windows 11, and Windows Server editions exposes sensitive memory contents due to a use-of-uninitialized-resource flaw (CWE-908), enabling a locally authenticated low-privileged user to disclose potentially sensitive kernel or heap data. Affected builds range from Windows 10 Version 1607 and Windows Server 2016 through Windows 11 23H2 and Windows Server 2022, covering a wide enterprise footprint. No public exploit or active exploitation has been identified; Microsoft has released patches for all confirmed affected builds.
Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.
Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.
Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.
Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Advanced Local Procedure Call (ALPC) allows an attacker already holding high administrative privileges to further escalate to kernel-level or system-level access via untrusted pointer dereference (CWE-822). The vulnerability affects a wide sweep of Windows releases - from Windows 10 version 1809 through Windows 11 26H1 and Windows Server 2019 through Server 2025 - and is confirmed patched by Microsoft. The CVSS scope-change flag (S:C) indicates the exploit crosses privilege boundaries beyond the initially compromised component, yielding full confidentiality, integrity, and availability impact on subordinate system resources. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Windows Wireless Wide Area Network (WWAN) Service on multiple Windows 10, Windows 11, and Windows Server editions contains an out-of-bounds read (CWE-125) that allows a locally authenticated low-privileged user to disclose sensitive contents from the service's memory. The flaw resides in the WWAN service process - responsible for managing mobile broadband connectivity - and affects system confidentiality without granting write access or code execution capability. Microsoft has released patched builds across all affected editions; no public exploit code or active exploitation has been identified at time of analysis.
Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).
Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Windows Encrypting File System (EFS) exposes sensitive memory contents to local low-privileged attackers via a buffer over-read (CWE-126) in its driver or associated components. Affected systems span the entire current Windows ecosystem including Server 2016 through 2025 and Windows 10/11 across multiple feature release channels. No active exploitation has been identified at time of analysis, but the breadth of affected versions and the sensitive nature of EFS - which handles file encryption keys and protected user data - elevates real-world impact beyond the moderate CVSS score suggests.
Security feature bypass in Windows Win32K allows a locally authenticated, low-privileged attacker to exploit a kernel-level race condition and circumvent an OS-enforced integrity control, yielding high integrity impact without any confidentiality or availability effect. The flaw spans virtually every supported Windows SKU from Windows 10 1607 through Windows 11 25H2/26H1 and Windows Server 2016 through 2025. Microsoft has released per-SKU patches; no public exploit code has been identified at time of analysis.
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.
Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.
Windows Modern Device Management (MDM) exposes a critical function without proper authentication, allowing a local low-privileged attacker to bypass MDM-enforced security policies on enrolled Windows endpoints. Affected versions span Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2019, 2022, and 2025. Microsoft has released patches addressing this integrity-only bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Remote Desktop Licensing Service enables a locally authenticated user to disclose sensitive memory contents on affected systems. The vulnerability spans a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 client builds, all covered under Microsoft's patch release. No public exploit code or active exploitation has been identified at time of analysis; with a CVSS of 5.5 and local-only attack vector, this is a moderate-severity information disclosure without integrity or availability impact.
Out-of-bounds read (CWE-125) in the Windows SMB Client component allows a locally authenticated low-privilege user to disclose kernel or heap memory contents on all supported Windows desktop and server versions. The flaw resides in the client-side SMB stack, meaning a valid local session is required rather than inbound network access; an attacker triggers the read by initiating or manipulating an SMB client operation. Microsoft has released patches covering the full affected version matrix; no active exploitation or public proof-of-concept has been identified at time of analysis.
Out-of-bounds memory read in Windows Remote Desktop Services (CWE-125) exposes arbitrary memory contents to a locally authenticated low-privileged attacker across virtually all supported Windows client and server releases. Affected versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this one of Microsoft's broadest-surface patch-cycle disclosures. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected version branches.
Out-of-bounds read in the Windows Win32K kernel graphics subsystem exposes kernel memory to locally authenticated attackers across a broad range of Windows client and server releases. The vulnerability (CWE-125) permits an attacker with low-privilege local access to disclose high-confidence memory contents - a class of primitive frequently chained with privilege-escalation exploits to defeat ASLR or leak kernel pointers. No public exploit code has been identified at time of analysis, and Microsoft has released patches for all affected product lines.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Out-of-bounds read in Windows Storage Spaces Controller allows a local, low-privilege authenticated attacker to disclose kernel memory contents on affected Windows systems. Spanning 19 product/version combinations from Windows Server 2012 through Windows 11 26H1, this is a medium-severity flaw (CVSS 5.5) constrained entirely to local access with no integrity or availability impact. Vendor patch is available via the Microsoft Security Response Center; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an unauthenticated attacker with physical device access to execute arbitrary code at kernel privilege level. Affected products span virtually the entire supported Windows ecosystem from Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patched builds across all affected versions; no active exploitation has been identified (not in CISA KEV) and no public proof-of-concept exploit is known at time of analysis.
Local integrity tampering in the Windows Search Component (CWE-306, Missing Authentication for Critical Function) affects virtually all supported Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - enabling a low-privileged, locally authenticated attacker to manipulate the component's behavior or data without passing an expected authentication gate. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms the impact is limited to integrity; no confidentiality or availability loss is expected. Microsoft has released patches via the standard update cycle; no public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Heap-based buffer overflow in the Windows RNDIS (Remote Network Driver Interface Specification) driver allows a physically present, unauthenticated attacker to disclose heap memory contents. Exploitation requires direct physical access to the target device, as the attacker must connect a malicious USB RNDIS device to trigger the overflow. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, making real-world risk low outside of targeted physical attacks.
Local integrity tampering in the Windows Speech component via a confused deputy (CWE-441) flaw allows an authenticated low-privileged attacker to cause unintended actions on behalf of a higher-privileged process or service, resulting in unauthorized file or system state modification. Affected scope spans Windows 10 (version 1607 through 22H2), Windows 11 (versions 23H2 through 25H2/26H1), and Windows Server 2016 through 2025, making remediation surface broad. Microsoft has released patches; no public exploit identified at time of analysis.
Out-of-bounds read in the Windows USB Mass Storage Class Driver exposes kernel memory to locally authenticated attackers across a broad swath of Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. The CWE-125 flaw allows an authorized low-privilege user to read beyond an allocated buffer in the driver, potentially leaking sensitive memory contents including kernel addresses or credentials cached in driver memory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released patches across all affected build trains.
Out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) exposes kernel or process memory to a locally authenticated low-privilege attacker across a wide range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability (CWE-125) is triggered locally without requiring user interaction, and the CVSS vector confirms confidentiality impact is high while integrity and availability are unaffected. No public exploit has been identified at time of analysis, and Microsoft has released patched builds via its cumulative update channel.
Privilege escalation via out-of-bounds read in the Windows USB Mass Storage Class Driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. An attacker with physical access to the target machine can connect a specially crafted USB storage device to trigger the kernel-mode memory flaw, potentially achieving complete system compromise (C:H/I:H/A:H per CVSS). No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected version branches.
Out-of-bounds read in Windows Image Acquisition (WIA) allows a local low-privileged attacker to disclose sensitive memory contents on unpatched Windows systems. The vulnerability affects a wide swath of Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, meaning virtually every supported and extended-support Windows environment is potentially in scope. No public exploit or CISA KEV listing has been identified at time of analysis, and the high attack complexity (AC:H) materially constrains opportunistic exploitation despite the breadth of affected versions.
Use-after-free in the Windows Overlay Filter kernel driver exposes stale freed memory to authenticated low-privilege attackers capable of reaching the target over a network. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through Server 2025, representing virtually the entire supported Microsoft Windows ecosystem. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in the Windows kernel-mode USB driver stack allows a locally authenticated low-privilege attacker to disclose arbitrary kernel memory contents on virtually every supported Windows release from Server 2012 through Windows 11 26H1. The CVSS 5.5 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects straightforward local exploitation with high confidentiality impact but no integrity or availability loss. No public exploit or CISA KEV listing is identified at time of analysis; a vendor-released patch is available from Microsoft.
Tampering in the Windows Search Component across virtually all supported and legacy Windows releases allows a local low-privileged attacker to bypass authorization checks and modify data or settings that should require elevated rights. The root cause is CWE-862 (Missing Authorization) - the component does not verify whether the requesting principal holds sufficient privilege before honoring the operation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Sensitive kernel-level system information is exposed to an unauthorized control sphere in the Windows Kernel, enabling any low-privileged local user to read data they should not have access to - a classic KASLR-defeating information disclosure. The flaw (CWE-497) spans an exceptionally wide range of affected platforms, from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV entry exists at time of analysis, but this class of kernel information disclosure is routinely chained with privilege-escalation exploits to defeat kernel address randomization.
Missing authorization in the Windows SMB Server component allows a locally authenticated attacker with low privileges to read sensitive information they are not authorized to access. The flaw, rooted in CWE-862, means the SMB Server fails to enforce proper authorization checks before returning data to a requesting principal. Affecting Windows 10, Windows 11, and Windows Server 2016 through 2025, this is a moderate-severity confidentiality issue with no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in the Windows kernel-mode driver Spaceport.sys allows an authenticated low-privileged attacker to disclose high-impact memory contents over a network, affecting all supported Windows versions from Server 2016 through Windows 11 26H1. Exploitation requires a low-privilege account and some form of user interaction (per CVSS PR:L/UI:R), limiting the practical attack surface compared to fully unauthenticated flaws. Reported by Microsoft MSRC via secure@microsoft.com; no public exploit code and no CISA KEV listing identified at time of analysis.
Out-of-bounds read in Windows Spaceport.sys exposes adjacent kernel memory to locally authenticated, low-privilege users across a broad range of Windows 10, 11, and Server releases. The flaw is classified CWE-125 and carries a CVSS 5.5 with high confidentiality impact but no integrity or availability consequence, making it an information-disclosure primitive rather than a full code-execution path. Microsoft has released patches; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds read in the Windows Storage Port Driver (storport.sys) enables a physically-present unauthenticated attacker to disclose memory contents from an affected system. Exploitation requires direct physical access to the target device, most plausibly via a maliciously crafted or manipulated storage peripheral. The vulnerability spans the entire currently-supported Windows ecosystem - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across all active feature releases. No public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Standard XPS document rendering component (CWE-125) allows a low-privileged local attacker to read beyond an allocated buffer boundary, disclosing adjacent memory contents on all supported Windows versions from Server 2012 through Windows 11 26H1. The flaw requires only a valid local user account and no user interaction, making it silently exploitable by any authenticated insider or post-compromise adversary seeking memory artifacts. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows allows a locally authenticated, low-privileged attacker to disclose kernel or process memory contents. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches via its regular update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Text Shaping component exposes adjacent process memory to a locally-authenticated attacker, enabling information disclosure without any user interaction. The flaw affects an exceptionally broad surface spanning Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with Microsoft-confirmed fix builds available. No public exploit or active exploitation has been identified at time of analysis, and the local-only attack vector limits exposure, but the high confidentiality impact (C:H) and trivial complexity once local access is obtained make patching advisable.
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Microsoft has released patches via the standard update cycle.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) subsystem on Windows exposes high-impact local information disclosure to low-privileged authenticated users. The flaw spans a wide swath of Windows releases - from Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 - making the remediation surface unusually broad. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the confidentiality impact is rated high because an out-of-bounds read can expose arbitrary kernel or process memory contents.
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated low-privilege attacker to disclose kernel memory contents across virtually all supported Windows desktop and server releases, from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-125) requires no user interaction and carries high confidentiality impact, making it a viable KASLR-bypass or sensitive-data-leak primitive in a multi-stage local privilege escalation chain. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local integrity tampering in the Windows Power Dependency Coordinator allows any low-privileged authenticated local user to invoke a critical system function without authentication, enabling direct manipulation of power dependency configurations across 19 Windows product variants from Server 2012 through Windows 11 26H1 and Server 2025. The vulnerability stems from a missing authentication check (CWE-306) on a function that controls hardware/software power state dependencies, a component present in every modern Windows installation. No public exploit code has been identified and the vulnerability does not appear in CISA KEV; Microsoft has released patched builds for all affected versions.
Out-of-bounds read in Windows Imaging Component (WIC) allows a locally authenticated attacker with standard user-level privileges to read memory contents beyond allocated buffer boundaries, disclosing potentially sensitive in-process data. The vulnerability affects an exceptionally wide range of Windows releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, confirmed by EUVD/NVD version data and reported directly by Microsoft MSRC. Microsoft has released targeted patches per platform build; no public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
Out-of-bounds read in Windows Remote Desktop Client exposes sensitive client memory to a network-adjacent attacker who can induce a user to connect to a malicious RDP server. The vulnerability (CWE-125) produces high-confidentiality impact with no integrity or availability loss, yielding a CVSS 5.7 score. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected Windows versions.
Buffer over-read (CWE-126) in the Windows Overlay Filter (WofFilter) kernel driver enables local authenticated attackers with standard user privileges to disclose kernel memory contents under high-complexity conditions. The vulnerability spans a broad range of supported Windows 10, Windows 11, and Windows Server releases from build 1607 through 26H1, all patched via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.7 medium score reflects the local, high-complexity exploitation barrier.
Windows License Manager on multiple Windows 10, 11, and Server editions exposes sensitive system licensing data to locally authenticated low-privileged users due to CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). An attacker with an existing local session can read confidential licensing information — such as activation data, product identifiers, or licensing metadata — without authorization. No public exploit code and no CISA KEV listing have been identified; vendor patches are available for all affected versions, reducing urgency for patched environments.
Out-of-bounds memory read in the Microsoft Standard XPS (XML Paper Specification) component affects virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a locally authenticated user to disclose potentially sensitive memory contents. The flaw (CWE-125) carries CVSS 5.5 with high confidentiality impact but no integrity or availability consequence; scope is unchanged and no user interaction is required beyond the attacker's own session. No public exploit code or active exploitation has been identified, and Microsoft has released patched builds across all affected version lines.
Out-of-bounds read in the Windows Push Message Routing Service exposes process or kernel memory to a locally authenticated attacker, resulting in sensitive information disclosure. The vulnerability affects a wide range of Microsoft Windows releases spanning Windows 10 through Windows 11 and Windows Server 2016 through 2025, making patch surface substantial across enterprise environments. No public exploit code has been identified at time of analysis, and the attack is constrained to local execution with standard user privileges.
Microsoft COM for Windows leaks sensitive information through error messages on a wide range of Windows 10, Windows 11, and Windows Server versions, allowing a locally authenticated attacker with standard user privileges to read high-confidentiality data. The flaw is rooted in CWE-209 (error message content exposure), where COM subsystem error paths disclose internal state that should not be visible to unprivileged callers. No public exploit or active exploitation has been identified at time of analysis, and Microsoft has released patches addressing all affected builds.
Windows GDI+ (Graphics Device Interface Plus) fails to initialize a resource before use (CWE-908), allowing a local low-privileged attacker to read residual memory contents and disclose potentially sensitive information from the affected system. The flaw spans virtually every supported Windows release - from Server 2012 through Windows 11 26H1 and Server 2025 - making it one of the broadest-footprint components affected. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Out-of-bounds read in the Windows USB Audio Class driver (usbaudio.sys) allows a local low-privileged attacker to disclose kernel-mode memory contents. The vulnerability spans a wide swath of Windows releases - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface operationally broad. Microsoft has released fixes via the standard update channel; no public exploit code and no active exploitation have been confirmed at time of analysis.
Local information disclosure in the Windows Connected User Experiences and Telemetry (DiagTrack) service allows a low-privileged authenticated local attacker to read sensitive data outside their authorized security scope. The CVSS scope-change metric (S:C) indicates the exposed data originates from a security domain beyond the telemetry component itself - likely higher-privileged OS subsystem data. Affecting Windows 10, Windows 11, and Windows Server 2019/2022/2025 across all mainstream support channels, Microsoft has released patches via the standard Patch Tuesday cadence. No public exploit identified at time of analysis.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Numeric truncation error in the Windows Internet Storage Name Service (iSNS) component enables a locally authenticated attacker to disclose sensitive information from affected systems. The flaw spans an exceptionally broad range of Microsoft Windows client and server editions - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch surface management complex. No public exploit or active exploitation is known at time of analysis; a vendor patch is available.
Out-of-bounds read in the Microsoft Standard XPS (XML Paper Specification) document processing stack enables a local low-privileged attacker to disclose sensitive memory contents under high-complexity conditions. The flaw spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2012 through Windows 11 25H2 and Server 2025 - making patch deployment across heterogeneous environments operationally significant. Microsoft has released patches via the standard update guide; no public exploit or active exploitation has been identified at time of analysis.