Windows 10 22h2
Monthly
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated, low-privileged attacker to gain full system-level control without additional user interaction. The root cause is CWE-862 (Missing Authorization): the MDM component fails to enforce authorization checks on operations that should require elevated privileges, enabling an attacker who already has local access to escalate to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, but the low complexity and broad Windows footprint make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Remote code execution in Windows Remote Desktop Client allows an authorized network attacker to fully compromise a victim's client machine by exploiting use of an uninitialized resource (CWE-908) during an RDP session with a malicious server. Every major Windows client and server release - Windows 10/11 in all currently-supported feature versions and Windows Server 2016 through 2025 including Server Core - is affected below specific cumulative update build thresholds. Microsoft has issued patches via the MSRC update guide; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. No public exploit has been identified at time of analysis, but Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Distributed File System (DFS) component allows a locally authenticated attacker to escalate privileges to SYSTEM-level access on affected Windows clients and servers. The vulnerability spans an exceptionally broad range of Microsoft Windows releases, from Windows 10 version 1607 and Windows Server 2012 through the most current Windows 11 26H1 and Windows Server 2025 builds. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Kernel Mode Driver affects virtually all current and several end-of-life Windows releases, from Server 2012 through Windows 11 26H1 and Server 2025. A low-privileged local attacker can trigger an integer underflow/wraparound in the kernel driver that manifests as a heap-based buffer overflow (CWE-122) in ring-0, enabling elevation to SYSTEM. No public exploit or CISA KEV listing is identified at time of analysis, but the extremely broad Windows footprint, low attack complexity, and no user-interaction requirement make this a high-priority cumulative update target.
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a locally authenticated attacker to escalate privileges to SYSTEM level. The flaw affects a broad swath of Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature-update channels - making it relevant to virtually any unpatched Windows environment. Microsoft has released corrective builds addressing the vulnerability, with no public exploit or active exploitation observed at time of analysis.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation in Windows USB Audio Class driver (usbaudio.sys) allows a local authenticated user to gain SYSTEM-level access via a use-after-free memory corruption condition. Affected versions span the entire supported Windows ecosystem from Server 2012 through Windows 11 26H1 and Windows Server 2025, making patch deployment at scale a significant operational task. No public exploit or CISA KEV listing is confirmed at time of analysis, but the AC:H rating reflects a race-condition exploitation window rather than a trivial trigger, distinguishing this from mass-exploitable LPE bugs.
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated, remote attacker run arbitrary code by delivering a malformed media file or stream that triggers an integer overflow leading to a heap-based buffer overflow. All supported Windows client and server editions from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 are affected below the fixed builds. Microsoft has released patches; no public exploit is identified at time of analysis, but the CVSS 9.8 unauthenticated network profile makes this a high-priority fix.
Privilege escalation in the Windows Volume Manager Driver allows a local authenticated user to gain SYSTEM-level access via an integer overflow/wraparound in the kernel-mode driver. The vulnerability spans virtually every supported and extended-support Windows release, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. Microsoft has released patches; no public exploit identified at time of analysis, though the low-complexity, no-interaction profile makes this a high-value post-exploitation primitive.
Local privilege escalation in the Windows TCP/IP stack exploits a race condition (CWE-362) to allow a low-privileged local user to gain full system-level control across virtually every supported Windows release. The vulnerability spans Windows 10 through Windows 11 25H2 and Windows Server 2012 through Server 2025, making the breadth of exposure exceptionally wide. Microsoft has released patches; no public exploit or CISA KEV listing was identified at time of analysis, but the scope of affected systems elevates organizational urgency.
Privilege escalation in the Windows Bluetooth Service enables a locally authenticated low-privileged user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions. The root cause is a race condition (CWE-362) in shared resource handling within the Bluetooth service, where competing threads can exploit an unsynchronized access window to trigger a privileged operation in the attacker's context. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing exists at time of analysis.
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. Microsoft has released patched builds across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Windows NDIS (Network Driver Interface Specification) allows a low-privileged authenticated attacker to gain full control of the target system through a kernel-level use-after-free condition. The flaw spans an exceptionally wide range of Microsoft platforms, from end-of-life Windows Server 2012 through current Windows 11 25H2 and Server 2025 builds. Exploitation is constrained by high attack complexity and required user interaction per the CVSS vector; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (CWE-122) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide product range - from Windows Server 2012 to Windows 11 25H2 and Server 2025 - making coordinated patch deployment a significant operational effort across enterprise environments. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released patches for all affected branches.
Stack-based buffer overflow in the Windows Broker Infrastructure Service (CWE-121) allows a locally authenticated low-privileged attacker to elevate privileges to SYSTEM on a wide range of Windows client and server editions. The vulnerability affects Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025, including Server Core installations. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Storage Management Provider enables a locally authenticated attacker to escalate privileges to SYSTEM-level on affected hosts. The vulnerability (CWE-122) spans virtually the entire Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - making its attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Privilege escalation in Windows Bluetooth Service via a use-after-free (CWE-416) allows a low-privileged local user to achieve full system compromise across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:L/AC:H/PR:L) indicates the flaw requires local access and elevated attack complexity - consistent with a race condition in Bluetooth service memory management - but yields full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released patches via its regular update channel.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Local privilege escalation in the Windows TCP/IP kernel driver affects virtually every supported Windows release, from Server 2012 through Windows 11 26H1. A low-privileged local attacker exploits a race condition (CWE-362) in a shared TCP/IP resource accessed concurrently without proper synchronization, winning the timing window to corrupt kernel state and elevate to SYSTEM. No public exploit or CISA KEV listing exists at time of analysis, but the breadth of affected platforms - 19 distinct Windows versions including all current Server SKUs - makes prompt patching essential, particularly on multi-user and shared-access systems.
Local denial of service in the Windows Virtual Hard Disk (VHD) Miniport Driver enables unprivileged attackers to crash the host operating system across every supported Windows release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through Server 2025. A malformed VHD operation submitted by a local user with no elevated privileges triggers a null pointer dereference (CWE-476) in the kernel-mode driver, producing an unhandled exception that results in a Blue Screen of Death and complete system outage. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Privilege escalation in Windows Modern Device Management (MDM) allows a locally authenticated, low-privileged attacker to gain full system-level control without additional user interaction. The root cause is CWE-862 (Missing Authorization): the MDM component fails to enforce authorization checks on operations that should require elevated privileges, enabling an attacker who already has local access to escalate to SYSTEM or equivalent. No public exploit code has been identified at time of analysis, but the low complexity and broad Windows footprint make this a meaningful patching priority.
Heap-based buffer overflow in the Windows Overlay Filter (WoF) kernel driver allows a low-privileged, authenticated attacker to escalate privileges over a network across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in a default-enabled kernel component, giving it a wide attack surface across the entire modern Windows ecosystem. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected product lines.
Privilege escalation via use-after-free (CWE-416) in the Windows Kernel enables a network-accessible, low-privileged authenticated user to elevate to SYSTEM privileges across a broad range of Windows client and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has confirmed and released fixed builds for all affected versions via the MSRC advisory. No public exploit code or CISA KEV listing has been identified at time of analysis; the high attack complexity (AC:H) and mandatory user interaction (UI:R) substantially reduce the near-term risk of automated mass exploitation despite the full C:H/I:H/A:H impact triad.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. Microsoft has released patches across all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) exploits a use-after-free condition (CWE-416), enabling an authenticated low-privileged attacker to gain SYSTEM-level access on affected Windows systems. The flaw spans a wide range of platforms from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis, though the high attack complexity (AC:H) suggests a race condition or timing-dependent exploitation path.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in Windows Active Directory Domain Services enables a locally authenticated attacker to escalate privileges to a higher integrity level, achieving full confidentiality, integrity, and availability compromise of the affected system. The vulnerability affects a broad range of Windows versions from Server 2016 through Server 2025, as well as Windows 10 and 11 across multiple feature release channels. No public exploit code or CISA KEV listing is identified at time of analysis, though the wide deployment footprint of AD DS in enterprise environments makes this a meaningful patching priority.
Remote code execution in Windows Remote Desktop Client allows an authorized network attacker to fully compromise a victim's client machine by exploiting use of an uninitialized resource (CWE-908) during an RDP session with a malicious server. Every major Windows client and server release - Windows 10/11 in all currently-supported feature versions and Windows Server 2016 through 2025 including Server Core - is affected below specific cumulative update build thresholds. Microsoft has issued patches via the MSRC update guide; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Use-after-free in the Windows Network Driver Interface Specification (NDIS) subsystem enables an authenticated network attacker to elevate privileges on affected Windows systems. The vulnerability spans a wide range of Windows client and server releases - from Server 2012 through Windows 11 and Server 2025 - and requires both low-privilege authentication and user interaction to exploit, substantially tempering the real-world risk relative to the high CIA impact scores. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through the July 2026 update cycle.
Heap-based buffer overflow in Windows Biometric Service (WinBioSrvc) enables local privilege escalation to SYSTEM on a wide range of Windows client and server platforms. An authorized local user with standard (PR:L) privileges can exploit this without user interaction, achieving full C:H/I:H/A:H impact on the vulnerable host. No public exploit or active CISA KEV listing is confirmed at time of analysis; the vendor patch is available via Microsoft's Patch Tuesday release cycle.
Heap-based buffer overflow in the Windows Fast FAT filesystem driver (fastfat.sys) enables local code execution across a wide range of Windows client and server versions. The vulnerability is reachable without elevated privileges (PR:N, AV:L) under high-complexity conditions, suggesting a crafted FAT volume - such as a malicious USB drive or mounted disk image - can trigger the overflow in kernel space. No public exploit or active exploitation has been identified at time of analysis, but the combination of full C:H/I:H/A:H impact and breadth of affected versions (Windows 10 through Windows 11 26H1 and Server 2012 through Server 2025) makes patching a priority for environments with physical or removable-media exposure.
Heap-based buffer overflow in Windows Print Spooler Components enables network-reachable authenticated attackers to escalate privileges to full system control, achieving high confidentiality, integrity, and availability impact. Affected versions span the entire current Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making this a broadly impactful privilege escalation path. Vendor-released patches are available via Microsoft's update guidance; no public exploit or KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Image Acquisition (WIA) allows an attacker with a low-privilege local account to gain SYSTEM-level access via a use-after-free memory corruption bug. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H2, making it a broadly applicable LPE primitive for post-exploitation chains. No public exploit or active exploitation has been identified at time of analysis; Microsoft has released patches through standard monthly update guidance.
Heap-based buffer overflow in the Windows NTFS kernel driver enables an authenticated low-privilege attacker to escalate to SYSTEM-level privileges via a network attack vector, affecting Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires user interaction and high attack complexity (AC:H), tempering the otherwise severe C:H/I:H/A:H impact profile. Microsoft has released patches across all affected build lines; no public exploit or CISA KEV confirmation is present at time of analysis.
Privilege escalation via double-free memory corruption in the Windows Registry subsystem allows a low-privileged, network-connected authenticated attacker - with required user interaction - to elevate to higher privilege levels, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually every supported Windows release from Server 2012 R2 through Windows 11 26H1 and Server 2025, representing an enormous aggregate attack surface. Microsoft has released patches via its standard update channel; no public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Heap-based buffer overflow in the Microsoft Windows XPS (XML Paper Specification) document processing component allows a low-privileged authenticated attacker to elevate privileges over a network. The vulnerability spans virtually all supported Windows client and server releases, from Windows 10 Version 1607 through Windows 11 Version 26H1 and Windows Server 2012 through Server 2025. Exploitation requires high complexity and active user interaction, preventing opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Win32K (the kernel-mode graphics subsystem) allows a low-privileged authenticated user to gain SYSTEM-level access by triggering a use-after-free condition. Affected across a wide span of Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. No public exploit code has been identified at time of analysis, and the high attack complexity rating (AC:H) in the CVSS vector suggests reliable exploitation requires precise memory timing or race-condition manipulation.
Remote code execution in the Windows Volume Manager Extension Driver, a kernel-mode storage component, affects virtually every supported-and several end-of-life-Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The CWE-122 heap-based buffer overflow is reachable over the network when a user interacts with attacker-controlled volume or share data, and successful exploitation yields full confidentiality, integrity, and availability compromise consistent with SYSTEM-level kernel execution. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches covering all affected build lines.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Use-after-free in the Windows Remote Access Connection Manager (RASMAN) service enables a locally authenticated attacker to escalate privileges to SYSTEM or equivalent. The flaw affects a wide range of Windows releases from Server 2012 R2 through the current Windows 11 25H2 and Windows Server 2025 builds. Microsoft has issued patches via the standard cumulative update channel; no public exploit or CISA KEV listing is present at time of analysis, though the broad attack surface and AC:H race-condition nature make this a meaningful LPE risk in enterprise environments.
Out-of-bounds read in Windows BranchCache allows an unauthenticated network attacker to crash the service, causing a denial of service on affected Windows systems. The flaw is rooted in improper bounds checking (CWE-125) within the BranchCache peer-caching protocol handler, and is exploitable across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. No public exploit code or KEV listing has been identified at time of analysis; vendor patch is available.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Heap-based buffer overflow in the Microsoft JScript scripting engine enables unauthenticated remote code execution across a broad range of Windows client and server platforms. The flaw (CWE-122) resides in the legacy JScript engine bundled with Windows 10, Windows 11, and Windows Server 2012 R2 through 2025, exposing systems to full confidentiality, integrity, and availability compromise without requiring user interaction. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; however, the high attack complexity (AC:H) indicates reliable exploitation demands skilled heap-grooming techniques, moderating the risk of opportunistic mass exploitation.
Type confusion in Windows Performance Monitor enables local privilege escalation across virtually every supported Windows release, from Windows Server 2012 through Windows 11 26H1. An authenticated local user can exploit the flaw to gain full control over confidentiality, integrity, and availability on the affected host. No public exploit has been identified at time of analysis, but the breadth of affected versions and the vendor-confirmed patch make this a high-priority patching item.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables an authenticated local attacker to escalate privileges on a broad range of Windows client and server releases. The flaw (CWE-122) requires only a low-privileged local session and no user interaction, making it a reliable second-stage payload in multi-step attack chains. Microsoft has released patches across all affected build lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the Windows USB Video Driver allows a locally authenticated attacker to gain SYSTEM-level access by exploiting a race condition in the driver's concurrent execution path. Affecting Windows releases from Server 2012 through Windows 11 26H1 and Windows Server 2025, the flaw (CWE-362) requires low-privilege code execution and tolerates no user interaction, but the high attack complexity reflects the timing window inherent to exploiting a race. No public exploit code or CISA KEV listing has been identified at time of analysis, though Microsoft has released patches across all affected branches.
Privilege escalation via use-after-free in the Windows Device Association Broker service affects a broad range of Microsoft Windows desktop and server releases, from Windows 10 1607/1809 through Windows 11 26H1 and Windows Server 2016 through 2025. An authenticated network attacker who can induce a user to interact with the vulnerable service can exploit the freed memory reference to gain full C:H/I:H/A:H impact - effectively achieving elevated privileges over the network. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the widespread prevalence of affected Windows versions makes patch prioritization important.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) subsystem allows a low-privileged authenticated attacker to escalate to full system-level privileges across a broad range of Windows versions. The flaw (CWE-122) requires high attack complexity and user interaction, making opportunistic mass exploitation less likely, but the full C:H/I:H/A:H impact on successful exploitation is severe. Patch versions have been released by Microsoft for all affected Windows builds; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in the Windows NTFS driver affects every supported Windows release from Server 2012 through Windows 11 25H2, allowing an authenticated local user to gain SYSTEM-level access. The root cause is an out-of-bounds read (CWE-125) in the NTFS kernel driver, which an attacker can trigger without user interaction once they have a local user session. Microsoft has released patched builds via Windows Update and the MSRC advisory; the breadth of affected versions - spanning client and server SKUs across more than a decade of releases - makes patch deployment the immediate priority.
Privilege escalation to SYSTEM via use-after-free in the Windows Audio Service affects a broad range of Windows 10, 11, and Windows Server versions from 2012 R2 through 2025. An authenticated local attacker can exploit a memory management flaw in the Audio Service to free an object while a reference to it remains live, then redirect execution to gain full C:H/I:H/A:H impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the wide product footprint and low privilege requirement make this a meaningful patching priority.
Privilege escalation via use-after-free in the Windows DNS service affects Windows 10, Windows 11, and Windows Server versions from 2012 R2 through 2025, allowing a locally authenticated low-privileged user to gain SYSTEM-level access. The CWE-416 flaw involves improper memory management in DNS handling routines where freed memory can be accessed and manipulated by an attacker with high-complexity exploitation - consistent with heap-grooming or race-condition prerequisites. Microsoft has released patches across all affected version lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. No public exploit or CISA KEV listing has been identified at time of analysis, though the Print Spooler service has historically been a high-value escalation target (PrintNightmare lineage).
Local privilege escalation in the Windows USB Audio Class kernel driver (usbaudio.sys) is achievable by any standard local user via a heap-based buffer overflow (CWE-122). The flaw spans nearly every supported Windows release from Server 2012 through Windows 11 26H1, making the attack surface extremely broad. An attacker who already holds a low-privileged local account can exploit this with low complexity and no user interaction to gain full control of the machine; no public exploit or active exploitation is confirmed at time of analysis.
Use-after-free in the Windows Search Component enables an authenticated low-privileged network attacker to elevate privileges, potentially achieving full system compromise (C:H/I:H/A:H). The vulnerability spans virtually the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making the unpatched population extremely large. Microsoft has released specific patch builds for each affected platform; no public exploit code or CISA KEV listing has been identified at time of analysis, but AC:H and UI:R constrain opportunistic mass exploitation.
Stack-based buffer overflow in Win32K, the Windows kernel-mode graphics and windowing subsystem, allows a low-privileged authenticated attacker to escalate privileges to SYSTEM level across a wide range of Microsoft Windows client and server editions. The network attack vector (AV:N) combined with user interaction requirement (UI:R) indicates the vulnerable code path can be triggered remotely, most plausibly through Remote Desktop Protocol sessions where Win32K processes graphical input on behalf of remote users. Patches are available from Microsoft for all affected versions; no public exploit or CISA KEV confirmation has been identified at time of analysis.
Local privilege escalation in Microsoft COM for Windows allows a low-privileged authenticated attacker to gain full SYSTEM-level control via a use-after-free memory corruption flaw. The vulnerability affects a broad range of current Windows client and server releases, from Windows 10 21H2 through Windows 11 25H2 and Windows Server 2022/2025. Microsoft has released patches via the standard update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Windows Biometric Service (WbioSrvc) allows a low-privileged authenticated local user to gain full SYSTEM-level control via a CWE-190 integer overflow that leads to memory corruption. The vulnerability spans a broad swath of Windows desktop and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - making the exposure surface very wide. No public exploit code or CISA KEV listing has been identified at time of analysis; the issue was reported through Microsoft's MSRC channel and a vendor patch is available.
Use after free in the Windows Device Association Service enables network-based privilege escalation by low-privilege authenticated attackers across Windows 10, Windows 11, and Windows Server 2012 through 2025. The CVSS 3.1 score of 7.1 accurately reflects meaningful exploitation constraints - high attack complexity, required user interaction, and prior authentication - despite the maximal CIA impact if exploitation succeeds. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via an out-of-bounds read in the Windows USB Driver affects a broad range of Windows client and server editions, enabling a locally authenticated low-privilege attacker to gain full SYSTEM-level control without user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no special setup required beyond a valid local session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ubiquitous Windows footprint and accessibility of the USB driver to standard user accounts make this a credible post-compromise privilege escalation primitive.
Heap-based buffer overflow in Windows Biometric Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local user - already holding a standard low-privileged account - can trigger the overflow to gain full SYSTEM-level control (C:H/I:H/A:H) without any user interaction. Microsoft has released patches through the July 2026 Patch Tuesday cycle; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables network-based remote code execution across virtually all supported Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network exploitability requiring one user interaction, likely triggered when a victim accesses or mounts a malicious network resource that causes the kernel-mode driver to process attacker-controlled data. Microsoft has released patches across the full affected version matrix; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows Storage Spaces Controller driver enables local privilege escalation to SYSTEM across a wide range of Windows client and server releases. An authenticated local user with low-privilege access can trigger the overflow without user interaction, yielding full confidentiality, integrity, and availability compromise of the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Microsoft has released patches addressing all affected build ranges.
Local privilege escalation in Windows Setup Files Cleanup affects virtually all supported Windows versions, from Server 2012 through Windows 11 26H1. The component improperly resolves symbolic links or junction points during file access operations, allowing a low-privileged local user to redirect cleanup actions to attacker-chosen file paths, effectively gaining write access to protected system locations. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected version branches.
Use-after-free in Windows Remote Desktop Services enables a low-privileged local attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, making the attack surface extremely broad across enterprise fleets. No public exploit code or CISA KEV active-exploitation entry has been identified at time of analysis; a vendor-released patch is available.
Heap-based buffer overflow in Windows DCOM Server enables a locally authenticated, low-privilege attacker to escalate to SYSTEM-level on affected hosts via a malformed DCOM activation or marshaling request. The vulnerability (CWE-122) spans effectively the entire active Microsoft Windows ecosystem - from end-of-life Server 2012 through current Windows 11 26H1 and Server 2025 - amplifying aggregate exposure significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of user interaction requirements make this a practical post-initial-access privilege escalation primitive.
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has released patches via the regular update cycle.
Local privilege escalation in Windows License Manager exposes authenticated local users to full system compromise via a use-after-free condition (CWE-416). An attacker with a low-privileged local session who can win a memory-management race condition can corrupt heap state and redirect execution to gain SYSTEM-level privileges across a wide range of Windows 10, 11, and Server editions. No active exploitation is confirmed (absent from CISA KEV) and no public exploit code has been identified, but the breadth of affected Windows versions - from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes this a meaningful patch priority for multi-user and enterprise Windows environments.
Local privilege escalation in Windows Push Notifications affects a broad range of Windows 10, Windows 11, and Windows Server releases. An authorized local attacker exploits a use-after-free (CWE-416) memory corruption condition to gain full system-level privileges, achieving high confidentiality, integrity, and availability impact within the vulnerable system. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Microsoft has released patches across all affected build lines.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows a low-privileged, authenticated attacker to achieve full SYSTEM-level compromise across Windows 10, Windows 11, and Windows Server 2019 through 2025. The flaw is a use-after-free (CWE-416) in the kernel-mode filter driver that underpins Windows cloud storage integration (OneDrive and compatible providers), where freed memory is reused in a way that allows an attacker to corrupt kernel objects and redirect execution. Microsoft has released patches across the affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv.dll) enables a locally authenticated attacker with standard user privileges to escalate to SYSTEM-level access on affected Windows systems. The flaw spans the entire modern Windows ecosystem - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is vendor-released and should be prioritized given lsasrv's privileged role in Windows authentication infrastructure.
Remote code execution in the Microsoft UxTheme Library (uxtheme.dll) across a broad range of Windows client and server releases stems from an integer underflow that leads to a heap-based buffer overflow. Microsoft rates it CVSS 9.8 with a network vector and no user interaction, meaning an attacker could achieve full compromise (confidentiality, integrity, and availability) if the vulnerable code path is reachable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Local privilege escalation in the Windows Kernel Streaming WOW Thunk Service Driver allows a low-privileged authenticated local attacker to gain SYSTEM-level access across a broad swath of Windows versions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability stems from a use-after-free (CWE-416) condition, a memory safety flaw in the WOW (Windows-on-Windows) 32-to-64-bit thunk layer used by the kernel audio/multimedia streaming subsystem. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Use-after-free in the Windows Win32K kernel subsystem allows an authenticated low-privileged attacker to escalate privileges to a higher level on affected Windows systems. Win32K is the kernel-mode graphics and windowing component; UAF memory corruption in this subsystem is a well-established privilege escalation class. The attack carries high complexity (AC:H) and requires user interaction (UI:R), and Microsoft has released patched builds across a wide range of Windows client and server versions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) document processing component enables an authenticated, low-privileged attacker to escalate privileges across a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11. Exploitation requires user interaction and high attack complexity, limiting automated or opportunistic attacks despite the network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches with confirmed fixed build numbers.
Heap-based buffer overflow in Microsoft's Windows XPS (XML Paper Specification) document handling component enables a network-reachable, low-privileged authenticated attacker to escalate privileges to a higher level, with full confidentiality, integrity, and availability impact on the affected system. The vulnerability spans an exceptionally broad range of Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 10/11. No public exploit or KEV listing has been identified at time of analysis, but a vendor patch is available.
Heap-based buffer overflow in usbaudio.sys, the Windows USB Audio Class kernel driver, enables a local low-privileged attacker to achieve full privilege escalation to SYSTEM-level code execution. The vulnerability affects every major Windows release from Windows Server 2012 and Windows 10 1607 through the latest Windows 11 26H1 and Windows Server 2025, representing an exceptionally broad patching scope. Microsoft has released build-specific patches for all affected OS versions; no public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification) on Windows allows a low-privileged local attacker to gain full system access via an integer underflow (CWE-191) that triggers memory corruption. The flaw affects a broad swath of Windows releases from Server 2012 through Windows 11 26H1. Microsoft has released patches across all affected branches; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation to SYSTEM in the Windows NTFS kernel driver affects virtually every supported Windows desktop and server release via an out-of-bounds read (CWE-125). An authenticated local attacker with only standard user privileges can exploit this memory-safety flaw in the NTFS driver to achieve full confidentiality, integrity, and availability compromise of the local system. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS (XML Paper Specification) component affects a broad range of Windows desktop and server editions, enabling a locally authenticated attacker with standard user privileges to escalate to higher privilege levels. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation requires physical or interactive local access and elevated attack complexity, but successful exploitation yields full C:H/I:H/A:H impact - consistent with achieving SYSTEM-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patches are available across all affected Windows builds.
Privilege escalation to full system control is possible in Windows Error Reporting (WER) across a broad span of Microsoft Windows desktop and server releases. An authenticated, low-privileged attacker who can trigger user interaction can exploit a heap-based buffer overflow (CWE-122) over the network to achieve high confidentiality, integrity, and availability impact - effectively gaining elevated privileges on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected versions and the network-exploitable nature of the flaw make it a significant enterprise patching priority.
Heap-based buffer overflow in Microsoft Standard XPS (XML Paper Specification), the Windows-integrated document format and print subsystem, enables a low-privileged local user to escalate to SYSTEM or administrator-level privileges across a broad range of Windows desktop and server releases. The flaw falls under CWE-122 and, given AC:L/PR:L/UI:N, requires only an existing standard user session and the ability to trigger XPS processing - no race condition or second-user interaction is needed. Microsoft has released patches for all affected builds; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Microsoft Standard XPS document handling component enables a locally authenticated attacker with low privileges to escalate to full system control across a broad range of Windows client and server releases. The vulnerability (CWE-122) resides in XPS processing logic and requires only a valid user account - no administrative rights - to trigger heap corruption and achieve arbitrary code execution at elevated privilege. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft's Standard XPS (XML Paper Specification) component across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025 enables a low-privileged authenticated attacker to escalate to full system control. Exploitation requires high attack complexity and active user interaction - consistent with a scenario where a specially crafted XPS document must be opened by the target. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor patch is available via Microsoft's update infrastructure.
Privilege escalation in Microsoft Standard XPS (XML Paper Specification), a document processing and print pipeline component embedded across Windows desktop and server editions, allows a locally authenticated low-privileged user to achieve full system compromise. The heap-based buffer overflow (CWE-122) produces high confidentiality, integrity, and availability impact (C:H/I:H/A:H) consistent with SYSTEM-level takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Windows Update.
Denial of service via out-of-bounds read in the Windows Message Queuing (MSMQ) Queue Manager allows an unauthenticated remote attacker to crash the service over a network. The vulnerability spans an exceptionally wide range of Windows releases, from end-of-life Server 2012 through current Windows 11 25H2 and Server 2025, making patching scope broad for any enterprise running MSMQ. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Local privilege escalation in Microsoft Standard XPS (XML Paper Specification) affects a broad swath of Windows operating systems via a heap-based buffer overflow in the XPS document handling component. An authenticated local attacker with standard user privileges can trigger the overflow to gain full system-level access, achieving high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is available.
Privilege escalation to SYSTEM level is achievable in the Windows Kernel across Windows 10, Windows 11, and Windows Server 2016 through 2025 via a heap-based buffer overflow (CWE-122). A local attacker with standard user credentials can trigger the overflow under high-complexity conditions to fully compromise kernel security structures, achieving complete confidentiality, integrity, and availability impact. Microsoft has released patched builds across all affected product lines; no public exploit has been identified at time of analysis.