Windows 10 21h2
Monthly
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
Denial of service in Microsoft Windows DirectX: a null pointer dereference reachable from a locally authenticated, low-privileged session crashes the affected graphics component, and because the flaw is scoped beyond its own component (S:C) the resulting availability loss is not contained to the attacker's own process. Affected platforms are Windows 10 21H2/22H2 (x64), Windows 11 23H2/24H2/25H2, and Windows Server 2022/2022 23H2/2025, all of which ship DirectX by default, so no non-default feature needs to be enabled beyond obtaining local code execution. Confidence in exploitation is low: EPSS is 0.46% (38th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry; the attack is local-only (AV:L) with no confidentiality or integrity impact.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Heap-based buffer overflow in the Windows Win32K GRFX kernel component allows a locally authenticated, low-privileged attacker to elevate privileges to SYSTEM on affected hosts. Impacted platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2, and Windows Server 2008 R2 SP1 through 2012 R2 as well as Server 2016/2019/2022 per vendor tagging. Exploitation requires an existing local foothold as a standard user (AV:L, PR:L, UI:N) and yields full confidentiality, integrity, and availability impact at CVSS 3.1 base 7.8 (HIGH); EPSS is 0.66% (49th percentile) and no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) lets a low-privileged, authenticated user who can already log on to a host run crafted input against the MSMQ service and elevate to SYSTEM-level privileges (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N, C:H/I:H/A:H). The exposure is limited by configuration: MSMQ is an optional Windows component that is not installed or enabled by default, so only hosts that have deliberately deployed the queue service are affected, and the flaw is not remotely exploitable on its own - it is a post-foothold escalation step that requires an existing local session. Affected platforms include Windows 10 1607, 1809, 21H2 and 22H2 and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2016 and 2019; no public exploit code has been identified at time of analysis and Microsoft's MSRC update guide entry is the authoritative remediation source. Overall this is a genuine but not top-tier priority: high impact if MSMQ is deployed, but gated behind local authenticated access and a non-default component.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
SMB Server might be susceptible to relay attacks depending on the configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally. Rated medium severity (CVSS 6.7). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.5). No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
Windows Shell path traversal vulnerability affecting Windows 10 21H2, Windows Server 2016, 2019, and 2022 allows an attacker with physical access to spoof system resources without requiring user interaction. The vulnerability has no patch available and poses a confidentiality risk through unauthorized information disclosure.
Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]
Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.
Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.
Improper access control in Windows Hyper-V enables privileged local users to read sensitive system information without authorization. The vulnerability affects Windows 10 (versions 21H2 and 22H2), Windows Server 2025, and Hyper-V implementations where an authenticated attacker with high privileges can bypass security controls to access confidential data. Currently no patch is available for this medium-severity issue.
Windows Remote Assistance contains a protection mechanism bypass that allows local attackers to circumvent a security feature without user interaction, affecting Windows 11 24h2, Windows Server 2012, 2022, and 2025. The vulnerability requires local access and user interaction to exploit, with potential impact limited to information disclosure. No patch is currently available for this medium-severity issue.
Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.
Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.
Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.
Local privilege escalation in the Windows Shell (the shell32/explorer component handling shell operations and namespace objects) lets an authenticated low-privileged attacker who can already run code on a Windows host race a shared resource against a concurrent privileged operation and cross a security boundary, gaining elevated rights on the same machine. The flaw is CWE-362 (improper synchronization / race condition) and carries CVSS 7.8 with Scope:Changed, reflecting that the vulnerable component's flaw impacts a component with different privileges, but the assessed vector (AC:H, PR:L, AV:L) means exploitation is non-deterministic, requires many timing attempts, and no remote or unauthenticated path exists. All supported Windows client and server branches are affected - Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2016 through 2025 - and no public exploit code has been identified at time of analysis, with no CISA KEV listing, so real-world risk sits below what the raw 7.8 score suggests in isolation.
Privilege escalation in the Windows Shell lets a low-privileged local attacker who already has code execution on a host defeat the shell's shared-resource synchronization and gain SYSTEM-level rights (scope change, high confidentiality/integrity/availability impact). Exploitation is constrained on three fronts: the attacker must already hold a local foothold (PR:L), must win a timing-sensitive race condition (AC:H per CWE-362), and must wait for a victim to perform a normal shell or file operation that the attacker can race (UI:R). Affected platforms are Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019/2022/2022-23H2/2025, with multi-user, RDP, and terminal-server hosts representing the highest-value targets; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution in the Windows Routing and Remote Access Service (RRAS) allows an unauthenticated remote attacker to achieve code execution on affected hosts, but only where the optional RRAS role is installed and enabled and a user is induced to connect to an attacker-controlled routing or VPN endpoint (UI:R). The flaw is an untrusted pointer dereference (CWE-822) in a service that normally runs with high privilege, and it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Server 2025. EPSS is 1.32% (70th percentile) and no public exploit code has been identified at time of analysis; Microsoft has published a security update and third-party detection and mitigation scripts are available, but the non-default nature of the RRAS role and the mandatory user interaction keep exposure limited.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) allows an authenticated attacker with low privileges to gain SYSTEM-level access on affected Windows 10, 11, and Windows Server systems (2008 R2 through 2025). The flaw is an improper access control (CWE-284) issue reachable by local code, requiring no user interaction; exploitation is limited to post-compromise escalation from a standard user to SYSTEM. No public exploit was identified at time of analysis, and EPSS is low (0.37%, 28th percentile).
Information disclosure in Microsoft's Windows Routing and Remote Access Service (RRAS) allows an unauthenticated, remote attacker to trigger a buffer over-read that leaks memory contents over the network. The exposed population is narrow: exploitation requires the optional RRAS role to be enabled (it is not installed by default on Windows 10/11 or Windows Server SKUs), and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates victim-side interaction is needed rather than a fully passive server-side hit. Impact is confined to confidentiality (C:H with I:N/A:N - no code execution, tampering, or denial of service), and no public exploit code has been identified at time of analysis (EPSS 1.08%, roughly the 64th percentile), making this a moderate, non-urgent issue.
Local privilege escalation in Windows Remote Access Connection Manager (RasMan) permits an authenticated low-privileged attacker to execute code with SYSTEM privileges via a use-after-free (CWE-416) or uninitialized resource memory corruption condition. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and multiple Windows Server editions, though no public exploit code or active exploitation has been identified at time of analysis (EPSS 2.2%, 82nd percentile). Exploitation requires the attacker to already have local interactive or programmatic access and does not require user interaction.
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
Local privilege escalation in the Windows Projected File System (ProjFS) component allows an authenticated attacker who already holds low-privileged code execution on a host to elevate to a higher-integrity context, including kernel/SYSTEM, through a memory-safety flaw reported as an integer overflow or wraparound. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation is strictly local and requires no user interaction, but it also offers no remote or network-facing path, which is the main limit on real-world risk. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not urgent patching priority for unpatched Windows 10, Windows 11, and Windows Server systems where ProjFS is active.
Local privilege escalation in the Windows Client-Side Caching (CSC) Service allows an authenticated attacker who already holds a low-privileged code-execution foothold on a Windows host to trigger a null pointer dereference in the service and escalate to higher privileges, rated CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Every affected build - Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2, 24H2 and 25H2, plus the listed Windows Server releases including Server 2008 SP2 x64 - includes the CSC/Offline Files component by default, so no non-default configuration is required for exploitation. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.40% (32nd percentile), consistent with a post-compromise escalation primitive rather than a remotely reachable threat.
Privilege elevation on Windows 10, Windows 11, and Windows Server systems is possible when a locally authenticated attacker able to run code as a low-privileged user triggers a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS), assigned CVSS v3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft rates the outcome as high impact to confidentiality, integrity, and availability of the elevated context, so the flaw functions as an escalation building block that converts a standard-user foothold into SYSTEM-level access rather than a standalone entry point; no remote path exists and user interaction is not required. No public exploit code has been identified at time of analysis and EPSS is low at 0.40% (32nd percentile), so exploitation is currently expected to be targeted and post-compromise rather than broad and opportunistic.
Denial of service in Microsoft Windows DirectX: a null pointer dereference reachable from a locally authenticated, low-privileged session crashes the affected graphics component, and because the flaw is scoped beyond its own component (S:C) the resulting availability loss is not contained to the attacker's own process. Affected platforms are Windows 10 21H2/22H2 (x64), Windows 11 23H2/24H2/25H2, and Windows Server 2022/2022 23H2/2025, all of which ship DirectX by default, so no non-default feature needs to be enabled beyond obtaining local code execution. Confidence in exploitation is low: EPSS is 0.46% (38th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry; the attack is local-only (AV:L) with no confidentiality or integrity impact.
A buffer over-read in the Windows Projected File System (ProjFS) kernel component lets a locally authenticated attacker who can already run code as a low-privileged user escalate to higher privileges on affected Windows 10, Windows 11, and Windows Server hosts. Because the flaw is reached through resource parsing (AV:L, PR:L, UI:N, AC:L), it is not remotely exploitable and serves primarily as a post-compromise escalation step rather than an initial access vector, but successful exploitation yields full loss of confidentiality, integrity, and availability on the host. No public exploit code has been identified at time of analysis and EPSS is low at roughly 0.4% (32nd percentile), so this is a genuine but not urgent priority - patch on the normal monthly update cadence, with faster turnaround on multi-user or high-value systems where local code execution is plausible.
Local privilege escalation in Microsoft Windows stems from a buffer over-read (CWE-126) in the Projected File System filter driver (prjflt.sys), a kernel-mode component that ships in-box with Windows 10 1809, Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2, and Windows Server 2019, 2022, 2022 23H2 and 2025. An authenticated attacker who already holds low-privileged local code execution on the host can trigger the over-read and, because the flaw is reachable in kernel context, gain SYSTEM-level elevation - CVSS 3.1 scores this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and no unusual complexity, but a mandatory local foothold. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.40% (32nd percentile), so this is a patch-on-cycle item rather than an emergency, with priority driven by the number of unpatched Windows endpoints exposed to post-compromise escalation. Microsoft published the fix through its standard monthly update channel (MSRC advisory CVE-2025-62461).
Heap-based buffer overflow in the Windows Win32K GRFX kernel component allows a locally authenticated, low-privileged attacker to elevate privileges to SYSTEM on affected hosts. Impacted platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 23H2, and Windows Server 2008 R2 SP1 through 2012 R2 as well as Server 2016/2019/2022 per vendor tagging. Exploitation requires an existing local foothold as a standard user (AV:L, PR:L, UI:N) and yields full confidentiality, integrity, and availability impact at CVSS 3.1 base 7.8 (HIGH); EPSS is 0.66% (49th percentile) and no public exploit or CISA KEV entry has been identified at time of analysis.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) affects supported Windows 10, Windows 11, and Windows Server builds, enabling a local attacker with low-privileged code execution to exploit an out-of-bounds read and gain elevated privileges. The vulnerability is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires an existing local foothold; it is not remotely reachable and needs no user interaction. No public exploit identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), so this is a genuine but not emergency-grade second-stage escalation issue.
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) lets a low-privileged, authenticated user who can already log on to a host run crafted input against the MSMQ service and elevate to SYSTEM-level privileges (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N, C:H/I:H/A:H). The exposure is limited by configuration: MSMQ is an optional Windows component that is not installed or enabled by default, so only hosts that have deliberately deployed the queue service are affected, and the flaw is not remotely exploitable on its own - it is a post-foothold escalation step that requires an existing local session. Affected platforms include Windows 10 1607, 1809, 21H2 and 22H2 and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2016 and 2019; no public exploit code has been identified at time of analysis and Microsoft's MSRC update guide entry is the authoritative remediation source. Overall this is a genuine but not top-tier priority: high impact if MSMQ is deployed, but gated behind local authenticated access and a non-default component.
Local privilege escalation in the Windows Storage VSP Driver allows an authenticated attacker with low-level privileges to elevate to SYSTEM on affected Windows systems. This post-access flaw requires the attacker to already have local code execution as a low-privileged user (PR:L, AV:L) and does not require user interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis, though the EPSS score is 2.45% (84th percentile), indicating a moderate likelihood of exploitation. Affected platforms include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 through 2025.
Local privilege escalation in the Windows Storage VSP (Virtual Storage Port) Driver allows an authenticated, low-privileged attacker who already has code execution on a Windows host to obtain SYSTEM-level control. Tracked as CVE-2025-59516 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw affects default installations of Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025); no user interaction is required once local access exists. Exploitation is a post-compromise escalation step rather than an initial-access vector: there is no remote or network-facing exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, while EPSS sits at 2.34% (83rd percentile), indicating elevated but not imminent exploitation likelihood.
Local privilege escalation in the Windows Projected File System (ProjFS) allows an authenticated attacker holding only standard-user rights to read out of bounds and elevate to full SYSTEM-level impact on affected Windows hosts. The flaw is scored 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning it is not remotely reachable and requires a pre-existing foothold with code execution as a low-privileged user; no user interaction is needed. EPSS is low at 0.40% (32nd percentile), no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV, though Microsoft has published a security update via its update guide.
Command injection in Windows PowerShell (CVE-2025-54100) lets an attacker execute arbitrary code in a victim's user context when that user opens or runs attacker-supplied content within the shell. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - it requires local access plus user interaction, not network reachability, so an attacker must first deliver a malicious script, file, or command and persuade the victim to execute it. It affects PowerShell as shipped by default across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 25H2), and Windows Server 2008 SP2 through 2025. EPSS is a modest 2.23% (82nd percentile), there is no confirmed active exploitation (not in CISA KEV), and no public exploit code has been identified at time of analysis, making this actionable but not emergency-tier.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to deny service over a network. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable. No vendor patch available.
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Untrusted pointer dereference in Storvsp.sys Driver allows an authorized attacker to deny service locally. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Multimedia Class Scheduler Service (MMCSS) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Improper privilege management in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Out-of-bounds read in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
External control of file name or path in Windows WLAN Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insertion of sensitive information into sent data in Windows Speech allows an authorized attacker to disclose information locally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Double free in Windows Smart Card allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
SMB Server might be susceptible to relay attacks depending on the configuration. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally. Rated medium severity (CVSS 6.7). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.5). No vendor patch available.
Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows BitLocker allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
Use after free in Windows UI XAML Phone DatePickerFlyout allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8). No vendor patch available.
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.