Windows 10 21h2
Monthly
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Win32K kernel graphics subsystem allows a low-privileged, authenticated remote attacker to elevate privileges to SYSTEM-level on affected Windows hosts. The flaw spans an exceptionally wide range of Microsoft Windows versions - from Server 2012 through Windows 11 26H1 and Server 2025 - making the potential blast radius substantial. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be applied promptly given the full C:H/I:H/A:H impact triad.
Stack-based buffer overflow in the Windows Fast FAT Driver (fastfat.sys) enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges on affected Windows hosts via a network attack vector. Spanning Windows 10 through Windows 11 and Windows Server 2012 through 2025, the flaw (EUVD-2026-73204) requires user interaction but yields complete confidentiality, integrity, and availability compromise of the targeted system. Microsoft has released patches across all affected version branches; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Spaces Controller driver allows a low-privileged local attacker to execute arbitrary code, almost certainly resulting in privilege escalation to SYSTEM or kernel-level access. The flaw (CWE-122) affects a broad swath of supported Windows releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025 - making it a high-priority patching target across both desktop and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local-EoP class is highly sought after for post-compromise lateral movement and sandbox escapes.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network connection. The vulnerability affects a broad swath of Microsoft Windows releases from Server 2012 through Server 2025 and Windows 10/11, and requires user interaction to trigger the memory corruption. Vendor patch is available; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local code execution via buffer over-read in the Windows NTFS driver affects a wide swath of Microsoft Windows releases, from Server 2012 through Windows 11 version 26H1. An authenticated local attacker with low-privileged access can trigger the CWE-126 flaw to achieve full C:H/I:H/A:H impact, indicating a kernel-level privilege escalation path rather than a simple memory leak. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patched builds for all affected product lines.
Local privilege escalation in Windows Print Spooler Components allows a low-privileged authenticated user to gain SYSTEM-level access on affected Windows hosts via a heap-based buffer overflow (CWE-122). The vulnerability spans a broad set of Windows releases, from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025, requiring only a standard local user account and no user interaction to exploit. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches for all affected versions.
Use-after-free in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables a locally-authenticated low-privileged attacker to escalate privileges to SYSTEM-level access. The vulnerability affects a broad range of current Windows releases - Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all receiving patched builds via Microsoft's update cycle. No public exploit code or CISA KEV listing has been identified at time of analysis, but the local privilege-escalation class and high C/I/A impact make this a credible post-compromise escalation path.
Privilege escalation via use-after-free in the Windows Kernel exposes an enormous swath of the Microsoft ecosystem - spanning Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - to network-reachable elevation of privilege by an authenticated attacker. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation is constrained by high complexity and a required victim interaction, but a successful attack yields full kernel-level confidentiality, integrity, and availability impact. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. No public exploit code and no CISA KEV listing exist at time of analysis, though the low-complexity, no-user-interaction CVSS vector renders this a realistic post-compromise escalation step requiring no special conditions beyond a standard user session.
Heap-based buffer overflow in Windows Storage Spaces Controller (CWE-122) enables a local attacker with low-privilege access to achieve full code execution at SYSTEM level on affected Windows hosts. Spanning the entire currently supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - the vulnerability's reach is exceptionally broad, though exploitation is bounded by the requirement for an existing local foothold. Microsoft has released patched builds for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows NTFS driver enables local privilege escalation across virtually every supported Windows version, from Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized low-privileged local attacker can trigger the overflow (CWE-122) with low complexity and no user interaction to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level access. No public exploit or KEV listing is identified at time of analysis, but the low attack complexity and broad platform coverage make this a high-priority patch for enterprise environments.
Privilege escalation in the Windows USB Driver subsystem allows a local authenticated attacker to gain SYSTEM-level privileges through a race condition in concurrent USB resource handling. Affected across a wide range of Windows releases - from Windows 10 1607 and Server 2012 R2 through Windows 11 26H1 and Server 2025 - the flaw is exploitable by any low-privileged local user who can time concurrent execution against the shared USB driver state. Microsoft has released patches as part of a security update cycle; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in the Windows USB Mass Storage Class Driver (usbstor/UASP stack) stems from a heap-based buffer overflow reachable when the driver parses attacker-influenced storage descriptors. Microsoft rates it CVSS 9.8 with a network attack vector, meaning an unauthorized attacker could execute arbitrary code, though the affected component is a USB device-class driver, which typically implies physical or proximate device presentation rather than pure remote access. A vendor patch is available across all supported Windows client and server builds; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the Windows NTFS driver enables a low-privileged, authenticated attacker to escalate privileges to higher system levels over a network, achieving full confidentiality, integrity, and availability compromise. The flaw spans a broad range of Windows releases - from Windows Server 2012 through Windows 11 version 26H1 and Windows Server 2025 - making the attack surface extensive. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via Microsoft's update guide.
Privilege escalation via use-after-free in the Windows File History Service allows a local authenticated attacker to gain full system-level access. The vulnerability affects a wide range of Windows 10, Windows 11, and Windows Server 2016/2019 builds, patched by Microsoft in the corresponding Patch Tuesday update cycle. No public exploit or CISA KEV listing is present at time of analysis, but the High CVSS score (7.0) and C:H/I:H/A:H impact metrics reflect the severity of successful exploitation.
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). No public exploit code has been identified at time of analysis and it does not appear in CISA KEV, but the breadth of affected versions and ubiquitous deployment make rapid patching critical.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Privilege escalation in Windows GDI+ (Graphics Device Interface Plus) allows a network-accessible, low-privileged attacker who can induce user interaction to gain SYSTEM-level or elevated privileges via an integer underflow that triggers a heap-based buffer overflow. The vulnerability spans virtually all supported Windows releases from Server 2012 through Server 2025 and Windows 11 version 26H1, making it exceptionally broad in scope. No public exploit code has been identified at time of analysis, but a vendor-released patch is available through Microsoft's Security Response Center.
Local privilege escalation in Windows Connected User Experiences and Telemetry (DiagTrack) allows an authenticated local user to elevate to SYSTEM-level privileges by winning a race condition against the SYSTEM-privileged service. The flaw spans Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025, all remediated in the associated Patch Tuesday release. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Active Directory Domain Services (AD DS) exposes domain controllers across Windows Server 2012 through 2025 to exploitation by low-privileged authenticated domain users via a use-after-free memory corruption flaw. The vulnerability (CWE-416) is reachable over the network but requires high attack complexity, likely a race condition or heap-grooming technique, to achieve fully controlled memory corruption resulting in arbitrary code execution with C:H/I:H/A:H impact. No public exploit has been identified at time of analysis; vendor-released patches are available for all affected Windows versions via the Microsoft Security Response Center.
Heap-based buffer overflow in Active Directory Certificate Services (AD CS) on Windows allows a locally authenticated, low-privileged attacker to escalate to full system control. Tracked under ENISA EUVD-2026-73369 and reported directly by Microsoft's security team, the flaw spans Windows Server 2012 through 2025 and multiple Windows 10/11 release tracks. Microsoft has released patches; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.
Authentication bypass by spoofing in the Windows Netlogon (MS-NRPC) protocol allows an unauthenticated adjacent-network attacker to impersonate domain authentication, yielding full confidentiality, integrity, and availability compromise of the targeted system. The flaw spans Windows 10, Windows 11, and Windows Server 2012 through Server 2025, making it a broad-surface Active Directory infrastructure risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the high CIA impact warrants prompt patching in domain-connected environments.
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
Local privilege escalation in Windows Push Notifications affects Windows 10, Windows 11, and Windows Server 2022/2025 via a use-after-free (CWE-416) memory corruption flaw, allowing a low-privileged authenticated local user to obtain SYSTEM-level execution. The vulnerability spans nine distinct Windows release branches - including server editions - broadening the enterprise attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; however, LPE primitives of this class are routinely integrated into post-initial-access attack chains.
Local privilege escalation in Windows Installer via a use-after-free (CWE-416) allows an authenticated user with standard privileges to achieve SYSTEM-level code execution across a broad range of Windows client and server releases. The vulnerability is confirmed by Microsoft MSRC and affects every major supported Windows version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit has been identified at time of analysis, and a vendor-released patch is available through Microsoft's update cycle.
Local privilege escalation via use-after-free (CWE-416) affects a broad swath of Microsoft Windows Server and Windows 10/11 releases, allowing an authenticated low-privilege attacker to gain SYSTEM-level access without user interaction. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a standard local account and no special configuration, making this a practical post-exploitation stepping stone in any multi-user or RDP-exposed Windows environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and Microsoft authorship of the report (secure@microsoft.com) suggest internal discovery and coordinated patch release.
Use-after-free in the Windows VHD miniport driver enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level access on affected Windows systems. The flaw is present across a broad range of Windows versions - from Windows 10 1809 and Server 2019 through Windows 11 25H2 and Server 2025 - making the attack surface extremely wide. Microsoft has released patches via its standard Patch Tuesday update mechanism; no public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to gain SYSTEM-level access via a race condition in kernel-level socket processing. The CVSS vector (AV:L/AC:H/PR:L/UI:N) reflects that exploitation requires an existing low-privilege foothold, precise timing to win the race window, but no user interaction. Microsoft has released patches across a wide range of supported Windows versions. No public exploit or CISA KEV listing has been identified at time of analysis, though race-condition LPE bugs in Windows kernel drivers are a favored post-exploitation technique.
Privilege escalation via heap-based buffer overflow in Windows Installer (msiexec) allows a low-privileged local user to gain full system control. Affected product is Microsoft Windows across versions that ship with the vulnerable Windows Installer component; exact version scope is defined by the MSRC advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog, though its low-complexity, no-user-interaction profile makes it a realistic post-foothold escalation tool.
Stack-based buffer overflow in the Windows Installer component (msiexec) enables local privilege escalation to SYSTEM on affected Windows systems. An attacker holding any standard local user account can trigger the overflow with low complexity and no user interaction required, achieving full compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog based on available data.
Privilege escalation in Windows Installer exposes all supported Windows systems to SYSTEM-level compromise by any low-privileged local user. The heap-based buffer overflow (CWE-122) in the Installer service requires only an authenticated local session - no user interaction, no elevated credentials, and low attack complexity per CVSS:3.1/AV:L/AC:L/PR:L/UI:N. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the ubiquity of Windows Installer and the straightforward exploitation conditions make this a meaningful post-compromise escalation primitive.
Local privilege escalation in Windows Installer (msiexec) stems from a stack-based buffer overflow (CWE-121) exploitable by any authenticated local user. An attacker with low-privilege access on an affected Windows system can trigger the overflow to gain full SYSTEM-level control, achieving complete confidentiality, integrity, and availability compromise of the local host. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad Windows deployment footprint make this a meaningful priority for patch management.